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THE TRANSPORTATION SECURITY 

ADMINISTRATION’S AVIATION PASSENGER 
PRESCREENING PROGRAMS: SECURE 

FLIGHT AND REGISTERED TRAVELER 


THURSDAY, FEBRUARY 9, 2006 

U.S. Senate, 

Committee on Commerce, Science, and Transportation, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:05 a.m. in room 
SD-562, Dirksen Senate Office Building, Hon. Ted Stevens, 
Chairman of the Committee, presiding. 

OPENING STATEMENT OF HON. DANIEL K. INOUYE, 

U.S. SENATOR FROM HAWAII 

Senator Inouye. The Chairman of this Committee is presently 
presiding at the U.S. Senate in his capacity as President pro tem- 
pore, so he sends his regrets he cannot be with you. 

The TSA has spent hundreds of millions of dollars on Secure 
Flight, Registered Traveler, and other airline passenger 
prescreening programs, yet we have been told that there are few 
tangible improvements in security to show for this investment. 

With respect to Secure Flight, Congress outlined specific privacy, 
security, and spending requirements for the agency to meet before 
moving forward with the program. Despite the TSA’s assurances 
that it would be operational within the year. Secure Flight has yet 
to be implemented. 

The Registered Traveler Program has experienced similar set- 
backs. The Nation’s air carriers have begun to call into question 
the necessity of the program. Others have raised concerns about 
the impact of the program on existing airport screening systems, 
and have questioned whether or not the program will produce an 
equitable and more secure program. 

To date, no one at the TSA has taken responsibility for this, and 
the lapses have squandered scarce public resources and delayed im- 
portant security improvements. These programs make sense, in 
theory, and we know that related technology is available. But will 
the traveling public ever realize the stated benefits? So, we need 
a far more candid and honest assessment than we have received 
thus far, and I look forward to hearing from Mr. Hawley about his 
next course of action. 

But before I call upon you, sir. Senator Lott? 

( 1 ) 



2 


STATEMENT OF HON. TRENT LOTT, 

U.S. SENATOR FROM MISSISSIPPI 

Senator Lott. Thank you, Senator Inouye — “Co-Chairman,” I be- 
lieve is the way we describe your title on this Committee. It’s a real 
pleasure to see the way you and Senator Stevens work together. I 
think it’s in the best interest of the Senate, and I wish more people 
would follow your example. 

Thank you for being here this morning. I’m looking forward to 
hearing the witnesses’ testimony we have before us now, and hope- 
fully even the next panel, even though I do have an Intelligence 
Committee hearing I must attend. And so, I thank all of you for 
being here, and I will review your statements that you have. 

You know. I’m quite often quick to be critical, and I have cer- 
tainly been critical many, many times, and with lots of justifica- 
tion, of the TSA. But I think, Mr. Hawley, that you’re trying to get 
it turned around. I see some small signs of a little common sense 
kicking in. Not a lot. But that’s the way it works in the Federal 
Government. Even if you get good, strong leadership at the top, it 
doesn’t seem to always get all the way down to the people on the 
ground, or to the gate, in the case of the airlines. But you’ve taken 
some criticism for the new screening procedures and changes to the 
prohibited-items list, and I want to make it clear, I think you did 
the right thing. I think you still haven’t done enough. I don’t know 
how many of my little pen knives I’m going to have confiscated, but 
I lost another one this past weekend. So, I just buy ’em by the 
dozen now. 

[Laughter.] 

Senator Lott. I do realize this is a serious threat to airlines, but 
I’ve gone from the black ones to the white ones, so I’ve got plenty 
of them. 

But you made some little small change. I mean, you’ve got all my 
little scissors. If you could just send them in a big box, I could 
probably use them. But you’re trying to do the right thing, and I 
want you to know that I appreciate it. I appreciate your attitude. 
And I appreciate the fact that you did something to begin to bring 
some modicum of common sense to the gates. 

Let me make just a couple of more points, then go to your testi- 
mony. 

I do want to make it clear that I’m absolutely opposed to the Ad- 
ministration’s suggestion to increase passenger security fees again. 
Congress rejected it last year. We’re going to reject it this year. 
Why waste your time, your breath, to suggest such a thing? Be- 
cause the airlines have got enough problems without that being 
added to it. Plus, I don’t think you need more money. I don’t think 
TSA needs more money. You need to do a better job with what you 
have. The budget request for 2007 is 4.607 billion. So, I think you 
need to find ways to do a better job with less money. 

And part of it is to quit fumbling around with things and make 
a decision, make it happen. How long do you — look, I could come 
over with a pencil and a napkin and design a program for the Reg- 
istered Traveler Program. At least you’re trying to make it work, 
but — I think — but now you’ve got milestones you’ve got to meet, 
and we may be able to get it in place by June. You get no awards 
for that. What’s wrong with April? What’s wrong with next week? 
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Get on with it. Because it’s — it wastes time and energy and money, 
and I don’t understand why it should he so hard to do that. 

Now, I guess the argument is going to be, from you and some 
people, “Well, we’re getting pushback because of privacy advocation 
concerns.” Forget that. If people don’t want to divulge their private 
information for this voluntary program, fine, they don’t get in it. 
I don’t understand what people are trying to hide. Get on with this. 

And that’s part of the problem, overall. I mean, you — the Secure 
Flight thing, we’ve been messing around with the CAPPS II and 
Secure Flight for 4 years, 200 — between 200 and 300 million. Do 
something, even if it’s wrong. And part of the problem, for instance, 
with regard to this — the registered flyer program is, industry offi- 
cials really don’t think you’re dedicated to moving the program for- 
ward; you really don’t want to do it, for some reason. I don’t know 
what it is. I don’t know if they know what it is. But enough money 
spent, let’s get some action. And we want to help you every way 
we can, and not be an impediment and a pain in your neck. I only 
call you and scream at you from BWI once a year. 

[Laughter.] 

Senator Lott. So — but it could increase. 

But we want you to succeed, because it’s very important work 
you do. We want secure flights, but we want some common sense 
applied in how people are screened and what the conditions are for 
flying. Let’s do some of these programs, or forget them, but quit 
fumbling around with them. 

Thank you for the opportunity to ventilate a little bit, Mr. Co- 
Chairman, and I’ll look forward to hearing the testimony. 

Senator Inouye. Thank you very much. 

Senator Lautenberg? 

STATEMENT OF HON. FRANK R. LAUTENBERG, 

U.S. SENATOR FROM NEW JERSEY 

Senator Lautenberg. Yes, thanks very much, Mr. Chairman. 

And I guess that’s wishful thinking. But to Senator Lott, talking 
about the confiscation of that weapon he’s carrying there, the fact 
of the matter is that I think this was originally a scheme by the 
scissor manufacturers to make sure that there was always an op- 
portunity to replace them. But in any event, the nuisance side of 
things is really just a plain pain in the neck, and we’ve seen that, 
now, scissors aren’t the weapon that they were intended to be. I’d 
trade in your knife for a pair of scissors. I think that’s probably the 
best way. But the fact is that we’ve got to get on with securing our 
aviation system and to make it more secure for passengers. 

My state lost 700 people in 9/11. Many people in New Jersey 
could see the flames and smoke at the World Trade Center from 
their homes and offices. And I was a Commissioner of the Port Au- 
thority before I came here; we had offices in the Trade Center. My 
home in New Jersey is right across the river from where the World 
Trade Center was. The absence of those two towers is obvious. The 
towers can be replaced, but the pain felt by the families can never 
be dealt with appropriately. 

After 9/11, we realized that our aviation system was not as safe 
and secure as it needs to be. We learned that some of the hijackers 
were known terrorists who never should have been allowed to 
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board a commercial flight. And that’s why this Committee created 
the Transportation Security Administration, and why we continue 
to oversee its activities. 

We must be certain that the American people, neighbors and our 
families, can travel safely. Considering the importance of this mis- 
sion, I share the words of Senator Inouye, and say that I’m dis- 
appointed by the Administration’s lack of progress in securing our 
transportation systems. Most of TSA’s resources have been directed 
toward aviation security. And when it comes to aviation, it would 
seem that TSA’s top priority should be to know when a suspected 
terrorist, or at least someone on the list, is attempting to board an 
airplane. And this fact was highlighted a few months ago when a 
man at Newark Airport got on a plane without even holding a valid 
ticket. He had taken a printed fare estimate that he got at the air- 
line ticket counter, and used it, along with his ID, to board an air- 
plane. If he had been a terrorist, we might not have known until 
it was too late. This lapse by both the airline and TSA highlights 
the importance of prescreening passengers, weeding out the few 
suspected threats from the millions of travelers that move each 
day. 

Now, I’d like to see a working passenger prescreening program 
that properly and efficiently matches passenger names with the 
suspected terrorist list. But this seems to be more of a challenge 
for TSA than anticipated. 

And as for the Registered Traveler Program, those of us who fly 
frequently would very much like a way to speed the process up for 
the kind of frequent flyers, as we call them. I don’t mean to say 
that those who spend the most money ought to get the best atten- 
tion, but the fact is that those who travel frequently by air are 
easier to identify, and we ought to get on with doing that. 

So, Mr. Chairman, this is a timely hearing. I look forward to 
hearing from our witnesses and hope that we can see some 
progress pretty soon. 

The Chairman, [presiding] Senator Nelson, do you have an open- 
ing comment? 

STATEMENT OF HON. E. BENJAMIN NELSON, 

U.S. SENATOR FROM NEBRASKA 

Senator Ben Nelson. Mr. Chairman, thank you very much. 

Just one observation. Going through an airport recently, I found 
that there were two lines. There was a line for those who flew first 
class and those who flew non-first class. Two different lines going 
through the same security screening process. Since I think we all 
pay the same amount for the screening process, I couldn’t under- 
stand the distinction between first-class lines to get through and 
the others. I can understand getting — riding in the — flying in the 
front of the plane, but I couldn’t understand that. And so. I’d like 
Mr. Hawley to be thinking about that before we get to the ques- 
tions. 

Thank you very much. And I appreciate also having this oppor- 
tunity for this hearing. 

The Chairman. Thank you very much. 
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OPENING STATEMENT OF HON. TED STEVENS, 

U.S. SENATOR FROM ALASKA 

The Chairman. I apologize for being late. I was in the Chair of 
the Senate. My relief was a little tied up in traffic. 

I think we should all recognize this is a first in a series of hear- 
ings on aviation security. The next hearing will be on March 9th, 
when we continue the evaluation of the airline passenger screening 
programs and examine the physical screening of airline passengers 
and their baggage. 

The purpose of today’s hearing is to examine two of TSA’s com- 
mercial aviation passenger screening programs, Secure Flight and 
Registered Traveler. The emphasis on today’s discussion I hope will 
be to review the policy and management issues that have pre- 
vented TSA from launching these programs, to determine the fu- 
ture of the programs. 

I do support the Administration’s efforts to secure all modes of 
transportation, as well as any program that yields a significant se- 
curity benefit to Americans, comparative to the cost of developing 
and operating the program. The programs at issue today have been 
in development now for 4 years, and, for various reasons, have not 
yet come to fruition. 

The Committee is going to seek answers from the witnesses here 
today regarding the cost of Secure Flight and the Registered Trav- 
eler Program and the necessity and viability of the programs, and 
the timetables related to them. 

I’m going to print the rest of my statement in the record. 

[The prepared statement of Senator Stevens follows:] 

Prepared Statement of Hon. Ted Stevens, U.S. Senator from Alaska 

We welcome the witnesses who will appear before the Committee today, and 
thank them for their willingness to participate in this hearing. 

Today represents the first in a series of hearings that the Committee will hold 
on aviation security. On March 9th, the Committee will continue its evaluation of 
TSA airline passenger screening programs, and examine the physical screening of 
airline passengers and their baggage. That hearing also will deal with screening 
technology, screener workforce issues, and TSA procurement processes. 

The purpose of today’s hearing, however, is to examine two of TSA’s commercial 
aviation passenger pre-screening programs. Secure Flight and Registered Traveler. 
The emphasis of today’s discussion will be to review policy and management issues 
that have prevented TSA from launching these programs, and to determine the fu- 
ture of the programs. 

I support the Administration’s efforts to secure all modes of transportation, as 
well as any program that yields a significant security benefit to Americans compara- 
tive to the cost of developing and operating the program. But the programs at issue 
today have been in development for four years and, for various reasons, have yet 
to come to fruition. 

The Committee will seek answers from the witnesses regarding the costs associ- 
ated with Secure Flight and Registered Traveler, the necessity and viability of the 
programs, and the timetables for their launch. The Committee also will examine the 
impediments that have caused delays, including privacy concerns, and even Con- 
gressionally imposed hurdles. 

I look forward to a constructive dialogue with the witnesses. 

The Chairman. We’re pleased to recognize the first panel: Ed- 
mund “Kip” Hawley, the Assistant Secretary for Transportation Se- 
curity, and Cathleen Derrick, who’s the Director of Homeland Secu- 
rity and Justice for GAO. 

We’ll call on you first. Kip. Thank you for your statement. 
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Your statements will be printed in the record in full. We appre- 
ciate the extent to which you can really reduce them down to ap- 
proximately 5 minutes. 

STATEMENT OF HON. EDMUND “KIP” HAWLEY, ASSISTANT 
SECRETARY, TRANSPORTATION SECURITY ADMINISTRATION 

Mr. Hawley. Good morning, Mr. Chairman, Co-Chairman 
Inouye, Members of the Committee. Thank you for the opportunity 
to discuss Secure Flight and the Registered Traveler Programs. 

In December’s hearing, we discussed the 14 layers of protection 
now in place for cockpits and passenger cabins, and our view of the 
current risk environment. These layers range from measures the 
government takes overseas to preempt attacks to the security 
measures in place on the aircraft itself. Today, I’m here to assist 
the Committee in considering activities toward the middle of the 14 
layers, passenger prescreening. 

Passenger prescreening can be broken down into three parts: 

One, identify known terrorists and prevent them from getting 
near the aircraft. This is the role of watch-list-matching, which is 
now done by airlines and will be transferred to the Government 
under Secure Flight. 

Second is to identify behaviors common to terrorists whose 
names we don’t know, and give them additional screening. This is 
the role of the computer-assisted passenger prescreening, or 
CAPPS, process. 

Third is to identify people who do not pose a threat to aviation 
security, so that we do not expend valuable security resources un- 
necessarily. This is the role of Registered Traveler. 

Secure Flight is the most important of these, and also the one 
requiring the most management attention. I’ll focus my opening re- 
marks on Secure Flight. 

The effort to improve terrorist watch-list screening, first through 
CAPPS II and subsequently under Secure Flight, was, and is, a 
complicated task. Despite sincere and dedicated efforts by TSA, 
there has been an undercurrent of concern from outside stake- 
holders really from the beginning. Over the past 4 years, many con- 
cerns have been raised and addressed, but Secure Flight continues 
to be a source of frustration. 

Congress recognized these issues when it included special certifi- 
cation requirements for the Secure Flight Program in recent appro- 
priations acts, and we appreciate GAO’s efforts to provide a com- 
prehensive review of the Secure Flight Program. 

We are in the process of making changes to how TSA operates, 
aligned with Secretary Chertoff’s risk-based strategy for the De- 
partment. I’ve previously shared with you our overall strategy, or- 
ganization changes that support that strategy, and in December we 
reviewed some of the operational steps that are now in action. 

As part of this continuing review, I asked TSA’s Information 
Technology Office to conduct IT system security audits of all TSA 
credentialing and vetting programs. This review, which includes 
Secure Flight, is ongoing, but I believe it is safe to say that many 
of the same issues identified by GAO are also highlighted by this 
more detailed review. 
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Rather than address any identified weakness on its own, I have 
directed that the Secure Flight IT systems go through the com- 
prehensive recertification process pursuant to the Federal Informa- 
tion Security Management Act, FISMA, requirements. This action 
and the others we’re taking, I believe, is compatible with GAO’s 
suggestions that we rebaseline the program and ensure that we use 
technology-development best practices in management, security, 
and operations. While the Secure Flight regulation is being devel- 
oped, this is the time to ensure that Secure Flight’s security, oper- 
ational, and privacy foundation is solid. 

We will move forward with the Secure Flight Program as expedi- 
tiously as possible, but in view of our need to establish trust with 
all of our stakeholders on the security and privacy of our systems 
and data, my priority is to ensure that we do it right, and not just 
do it quickly. 

When I appeared before the Committee during the confirmation 
process, I said that I believe programs like Secure Flight should be 
built from a strong privacy foundation as a starting point, as op- 
posed to building it and then adding privacy. The approach I just 
outlined will accomplish that. Security and privacy are necessary 
ingredients of each other, and not opposite ends of the spectrum. 
TSA will approach all of its programs with that in mind. 

On Registered Traveler, I will just say that it will be market- 
driven and offered by the private sector. TSA’s principal require- 
ments are that, one, it pays its own way, and, two, does not dimin- 
ish security. We are fully aware that terrorists may attempt to ex- 
ploit Registered Traveler Program benefits, and the program is de- 
signed to thwart those efforts. 

On November 3, 2005, I outlined the path forward for Registered 
Traveler. We are on track, having met the milestones established 
for January 20th. Depending on the pace of our market-driven pri- 
vate-industry partners, TSA expects to be ready to begin screening 
Registered Traveler Program applicants by mid-June. 

Mr. Chairman, I look forward to working with you and the Com- 
mittee. 

Thank you. 

[The prepared statement of Mr. Hawley follows:] 

Prepared Statement of Hon. Edmund “Kip” Hawley, Assistant Secretary, 
Transportation Security Administration 

Good morning Mr. Chairman, Co-Chairman Inouye, and Members of the Com- 
mittee. I am pleased to have the opportunity to appear before you today on behalf 
of the Transportation Security Administration (TSA) to discuss non-physical secu- 
rity screening programs. As requested, my testimony will focus on the Secure Flight 
and Registered Traveler programs, two promising programs that can play an impor- 
tant role in our comprehensive, multi-layered aviation security network. 

Last fall, before this Committee, I shared the key principles that are guiding the 
work and priorities of TSA. Secure Flight and Registered Traveler are rooted in two 
of these principles: using risk/value analysis to make investment and operational 
decisions, and making the best possible use of coordinated interagency intelligence 
and information. 

Secure Flight will enhance our ability to identify known or suspected terrorists 
before they attempt to pass through the airport security checkpoint. It builds upon 
the work of the law enforcement and intelligence agencies who provide the informa- 
tion necessary to prescreen passengers, and recognizes that our strongest defense 
against terrorism is to detect terrorists before an attempt to attack. 
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Registered Traveler focuses on people at the other end of the threat spectrum. It 
is intended to enable people who are not considered threats to aviation security to 
move more quickly through the security process. The program is expected to reduce 
the time and resources that must he devoted to screening such individuals at the 
airport screening checkpoint, allowing TSA to focus more attention and resources on 
people we know less about and who may pose a greater threat to aviation security. 

Secure Flight 

Computerized screening of airline passengers predates the creation of TSA. The 
Computer-Assisted Passenger Prescreening System (CAPPS), a joint effort by air- 
lines and the Federal Government, has been used to screen passengers since the 
mid-1990s. The CAPPS program uses an algorithm that draws upon information in 
passenger name records (PNRs) to determine whether a passenger and his or her 
property should receive a higher level of security screening prior to boarding an air- 
craft. 

The Aviation and Transportation Security Act (ATSA) (Pub. L. 107-71), which 
created TSA, mandated that computerized passenger prescreening continue on an 
expanded basis. Since 9/11, we have added more comprehensive computerized pre- 
screening measures and enhanced CAPPS processing rules. Today, airlines must 
also compare passenger names to the names on two consolidated Federal Govern- 
ment watch lists known as the No-Fly and Selectee lists. These watch lists are the 
product of an on-going interagency effort, and are maintained by the Terrorist 
Screening Center, a multi-agency center administered by the Federal Bureau of In- 
vestigation (FBI). TSA continues to work closely with the Terrorist Screening Center 
to ensure that the watch lists are accurate and comprehensive. In addition, TSA 
maintains a list of individuals who have a similar name to someone on the watch 
list, but who have already been distinguished from that person through TSA’s re- 
dress process. These lists are made available to air carriers on a daily basis for use 
in carr 3 dng out the watch list matching function. 

When an air carrier finds a passenger with a name on the Selectee list, the car- 
rier must identify that passenger to TSA for enhanced screening at the checkpoint. 
When an air carrier finds a passenger has a name identical or similar to a name 
on the No-Fly list, the carrier must contact TSA in order to verify whether the pas- 
senger is actually the individual of interest to the government. If it is determined 
that the passenger is in fact the individual named on the No-Fly list, the carrier 
is prohibited from transporting that passenger and may contact law enforcement. 
As there are no children on the watch list, TSA permits airlines to deselect children 
under 12 without contacting TSA. TSA runs a 24-hour/7-day watch center to coordi- 
nate the resolution of issues related to watch list matches and other operational 
matters. 

As recommended by the 9/11 Commission and mandated by the Intelligence Re- 
form and Terrorism Prevention Act of 2004 (IRTPA) (Pub. L. 108-458), TSA is tak- 
ing steps to assume the passenger watch list matching function from the airlines 
through the Secure Flight program. The CAPPS screening function will remain with 
the airlines. 

Under Secure Flight, the watch list screening process will generally occur prior 
to an individual’s arrival at the airport, unless he or she makes a reservation or 
changes a flight upon arrival at the airport. Rather than transmitting watch lists 
to air carriers, under Secure Flight, air carriers will transmit passenger names and 
a limited amount of additional identif 3 dng data for flights within the United States 
to a central data processing unit. Passenger names will be compared to names on 
the consolidated watch lists, as well as a list of individuals who have already been 
distinguished from persons on the watch lists through the redress process. 

Similar to current practice, if an individual is confirmed as a match to the Se- 
lectee list, TSA will notify the appropriate air carrier, who is then required to take 
steps to identify the individual as a selectee so that TSA Transportation Security 
Officers can apply enhanced screening to the individual and his or her property at 
the checkpoint. If TSC confirms a match to the No-Fly list, TSA will notify the air 
carrier to refuse to issue the passenger a boarding pass. The Terrorist Screening 
Center will assist in the match confirmation process and may notify other agencies 
to initiate an operational response to the match, if appropriate. 

We expect that watch list screening under Secure Flight will offer significant im- 
provements in security, efficiency and the passenger experience. It should be noted 
that any individual who is identified as “No-Fly” by a government agency is not al- 
lowed to board an aircraft under the system in operation today. Nevertheless, secu- 
rity will be enhanced by vetting passengers against the expanded watch lists pro- 
duced by the TSC, instead of the more limited lists TSA currently transmits to car- 
riers. Further, by moving the watch list screening process within the Federal Gov- 
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ernment, comparisons will be made using a single system, rather than the multiple 
matching programs now utilized by individual airlines. 

Additionally, we believe the Secure Flight system will reduce the number of pas- 
sengers who are misidentified as an individual on the watch list. By incorporating 
a limited amount of additional passenger information in the comparison process and 
by offering tighter integration with TSA’s redress process, we expect Secure Flight 
to more easily and accurately distinguish passengers with similar names from those 
on the watch list. TSA fully appreciates the frustration of passengers facing this 
false positive match issue, and we are working diligently to reduce the inconven- 
ience these passengers experience. As part of this effort, TSA’s Office of Transpor- 
tation Security Redress will implement a redress process that will permit pas- 
sengers who are delayed or prohibited from boarding a flight to appeal and correct 
erroneous information. The Office will work in consultation with stakeholders and 
companion offices including the TSA Office of Civil Rights and the DHS Officer for 
Civil Rights and Civil Liberties in implementing this process. 

I also want to assure the Committee that we are fully committed to protecting 
passenger privacy with the deployment of Secure Flight by incorporating privacy 
protection features into the system design. We will follow both the letter and intent 
of the Privacy Act, and we will continue to design, develop, and deploy Secure Flight 
in consultation with TSA and DHS Privacy Officers and privacy advocates. 

TSA is pursuing a phased development and deployment approach to Secure 
Flight. Initial development and testing of the Secure Flight matching application is 
nearing completion. In September and November of 2004, we published a number 
of documents necessary to begin testing the Secure Flight matching application, in- 
cluding a Privacy Act System of Records Notice (SORN) and a Privacy Impact As- 
sessment (PIA). Testing of the matching application using historical Passenger 
Name Records was successful. Development and testing of TSA communication links 
to the Terrorist Screening Center and Customs and Border Protection (CBP), 
through which we intend to connect to the airlines, as well as fine-tuning of the 
matching application, will continue through the next phase of Secure Flight’s devel- 
opment. 

In addition to application testing, TSA conducted a separate test to determine 
whether the use of additional data sources produced by commercial data aggregators 
could be used to identify potentially inaccurate or incomplete passenger data and 
add an additional layer of security in passenger prescreening. As a result of those 
tests, commercial data analysis will not be included in the operational deployment 
of Secure Flight. 

During the next phase, we will undertake operational testing of Secure Flight by 
connecting with several airline partners and vetting passenger information in real 
time. During this phase, participating air carriers will be required to continue 
screening passenger names against the watch lists that are provided to them. We 
are currently in the process of drafting the necessary regulatory documents to im- 
plement operational testing, including the System of Records Notice (SORN) and 
Privacy Impact Assessment (PIA) for Secure Flight. Once this regulatory process is 
concluded, operational testing will begin. 

Based on the operational tests, TSA will make adjustments to the systems and 
operations as necessary, and prepare for the phased deployment of Secure Flight. 
As you may be aware, the Department of Homeland Security Appropriations Act, 
2006 (Pub. L. 109-90), prohibits TSA from expending funds to deploy Secure Flight 
until the Secretary of Homeland Security certifies, and the Government Account- 
ability Office (GAO) reports, that all ten of the elements contained in Section 522 
of the Department of Homeland Security Appropriations Act, 2005 (Pub. L. 108- 
334), have been met. 

We appreciate GAO’s efforts to provide a comprehensive review of the Secure 
Flight program, especially in light of the difficulties in reviewing a complex program 
that is still under development. TSA intends to make the required certification after 
completion of operational testing, and will fully cooperate with GAO as it completes 
its review of Secure Flight within the 90-day post-certification reporting deadline. 
We are confident that Secure Flight will meet all Congressional requirements for 
implementation. 

Registered Traveler 

The Aviation and Transportation Security Act (ATSA) also directed TSA to ex- 
plore options for expedited travel at airports for people who do not pose, and are 
not suspected of posing, a security threat. 

Registered Traveler Pilot programs were initiated in five airports on a staggered 
basis during the summer of 2004. In partnership with Northwest Airlines, United 
Airlines, Continental, and American Airlines, TSA established pilot programs at 
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Minneapolis-St. Paul (MSP), Los Angeles (LAX), Houston Intercontinental (lAH), 
Boston (BOS), and Ronald Reagan Washington National (DCA). Each of the five 
pilot programs enrolled approximately 2,000 people, who were invited to participate 
by the airlines from among their very frequent fliers. Participation was limited to 
U.S. citizens, nationals, and lawful permanent residents, and was entirely vol- 
untary. Participants in these TSA run pilot programs were not charged a fee. The 
five initial pilots ended in September 2005. 

In June 2006, TSA initiated a sub-pilot program at Orlando International Airport 
(MCO) to test the feasibility of using a public-private partnership model for the pro- 
gram. The sub-pilot also tests the willingness of the public to pay a fee to partici- 
pate in a Registered Traveler Program. In the Orlando sub-pilot, participants pay 
an annual fee of $80. Approximately 13,000 passengers have enrolled in the sub- 
pilot, which is still in operation. 

The results of the pilot programs were positive. Tests of biometric identity 
verification and smart card technology demonstrated that the technology performs 
accurately and rapidly under airport operational conditions. Furthermore, based 
upon the results of the Orlando sub-pilot, we concluded that the public will accept 
the participation of private companies in the Registered Traveler program and that 
a fee-based program can attract participants. 

In keeping with Congressional direction and consistent with the results of the 
pilot and sub-pilot programs. Registered Traveler programs will be market-driven, 
and offered by the private sector. Individual participation in a Registered Traveler 
program will be entirely voluntary, with prices established by the private sector pro- 
viders. 

On November 3, 2005, I shared with Congress an aggressive schedule for the de- 
velopment and implementation of interoperable Registered Traveler programs na- 
tionwide. On December 15, TSA issued a Request for Information to assist in the 
identification of one or more business models for the program that will meet the re- 
quirements for nationwide interoperability, sustainability through user fees, and 
scalable operations. Responses were due to TSA on January 20, 2006. Based on ini- 
tial responses, TSA sought additional comments and extended the response deadline 
to January 30. 

Also on January 20, TSA provided guidance to the industry regarding the collec- 
tion of biometrics and their storage on Registered Traveler smart cards, as well as 
information regarding the process for seeking redress of an unfavorable eligibility 
or revocation decision. 

Biometrics will be collected and stored in accordance with already existing stand- 
ards, including Federal Technical Implementation Guidance on smart cards and the 
American National Standards Institute/International Committee for Information 
Technology Standards (ANSI/INCITS) standards for biometrics. Participants will be 
expected to provide images of all ten fingerprints at enrollment, with necessary ac- 
commodations for physical limitations. Templates of two or more fingerprints will 
be stored on smart cards for identity verification at security checkpoint kiosks. Reg- 
istered Traveler program requirements will be harmonized with the DHS-State De- 
partment P.A.S.S. System (People, Access, Security, Service), the credentialing effort 
recently announced by Secretaries Chertoff and Rice, and other government-spon- 
sored travel facilitation programs, as they are developed. 

Redress matters will be handled by TSA’s Office of Transportation Security Re- 
dress until the consolidated traveler screening redress process envisioned by the 
Rice-Chertoff initiative is developed and implemented. As part of the redress proc- 
ess, applicants pursuing an appeal may be asked to provide additional information 
and documents for necessary processing. Applicants will receive the results of their 
appeal in writing. All Registered Traveler data will be handled in compliance with 
the Privacy Act. 

Finally, we announced that TSA intends to mandate a core security assessment 
for each applicant to a Registered Traveler program. If providers undertake more 
in-depth security background checks, TSA will authorize a variety of enhanced or 
time-saving participant benefits at passenger screening checkpoints. Participants 
may receive significant efficiency benefits over what exists today, if additional secu- 
rity is added by a more thorough threat assessment. Registered Traveler will also 
include ongoing checks of participants to ensure that TSA is notified of potentially 
disqualifying information available after the initial threat assessment. Furthermore, 
if Registered Traveler providers wish to make investments in approved screening 
equipment, fund additional screeners, and/or obtain space for separate Registered 
Traveler screening, then TSA is prepared to authorize the use of dedicated screening 
lanes or alternative screening locations for participants. 

We are fully aware and expect that terrorists may seek to exploit Registered Trav- 
eler program benefits, and we are working to design a program to thwart those ef- 



11 


forts. Therefore, program benefits can be expected to change from time to time in 
order to make it difficult for terrorists to anticipate our security activities. In addi- 
tion, TSA will not exempt Registered Traveler participants entirely from random se- 
lection for secondary screening. 

By late April, TSA expects to select an entity to certify service providers and man- 
age compliance, and will begin issuing necessary amendments to Airport Security 
Plans to establish requirements for identity verification providers. The period for 
parties to submit plans for achieving interoperability of Registered Traveler pro- 
grams will also close at that time. TSA plans to be ready to begin screening Reg- 
istered Traveler program applicants in mid-June, provided that our private industry 
partners have successfully enrolled applicants by that time. 

Conclusion 

TSA’s mission is to protect the Nation’s transportation systems while facilitating 
the movement of people and commerce. Both Secure Flight and Registered Traveler 
can enhance our aviation security network, and we look forward to working with 
the Committee to implement these promising programs. 

Thank you again for the opportunity to testify today. I will be pleased to respond 
to questions. 

The Chairman. Thank you very much. 

Our next witness is Ms. Berrick. 

STATEMENT OF CATHLEEN A. BERRICK, DIRECTOR, 

HOMELAND SECURITY AND JUSTICE ISSUES, U.S. 

GOVERNMENT ACCOUNTABILITY OFFICE 

Ms. Berrick. Thank you, Mr. Chairman, Co-Chairman Inouye, 
and Members of the Committee, for inviting me to discuss the de- 
velopment of Secure Flight, a program designed to identify domes- 
tic passengers who should be denied boarding or who should under- 
go additional security scrutiny prior to boarding a flight. 

My testimony today focuses on the development and oversight of 
Secure Flight, TSA’s coordination with key stakeholders that are 
critical to the program’s success, and TSA’s efforts to protect pas- 
senger rights and privacy. 

Overall, our work has found that TSA faces significant chal- 
lenges in implementing Secure Flight, that the system is at risk of 
not meeting program goals. We’ve found that TSA has not con- 
ducted critical activities consistent with best practices for large- 
scale IT systems. TSA has also not followed their own established 
systems development process for Secure Flight. For example, offi- 
cials declared the design phase of Secure Flight complete before 
fully defining system requirements. As a result, it’s not clear what 
Secure Flight capabilities will be delivered when, and at what cost, 
and it has been difficult to measure the extent of progress on this 
program. 

We also found that TSA has collaborated with key stakeholders 
whose participation is essential to support Secure Flight, and we 
are encouraged by these efforts. However, these stakeholders have 
stated that they need more definitive information from TSA about 
Secure Flight requirements in order to be able to support the pro- 
gram. 

TSA has also begun coordinating with other DHS people-screen- 
ing programs in order to achieve efficiencies and commonality; 
however, it remains unknown what changes, if any, will be made 
to Secure Flight or the prescreening process as a result of these ef- 
forts. 



12 


We also found that TSA must still make key policy decisions that 
will significantly influence program effectiveness, including what 
passenger data TSA will require air carriers to provide. 

Finally, Secure Flight’s requirements documentation does not 
fully explain how passenger privacy protections will be met, and 
TSA has not yet issued privacy notices that describe how it will 
protect passenger data for an operational system. As a result, it’s 
not possible for us to fully assess how TSA is addressing privacy 
concerns. 

Since we last reported on Secure Flight, in March of 2005, TSA 
has made some progress in all of these areas, including conducting 
further system testing and working to establish connectivity need- 
ed to make the system operate. As Assistant Secretary Hawley just 
mentioned, TSA has also recently taken additional steps to instill 
more discipline into the development of Secure Flight, including 
hiring a program manager with information-systems credentials 
and rebaselining the program to more fully defined requirements 
and establish milestones and cost estimates. We believe that these 
activities are critical, and must be completed before Secure Flight 
is positioned, so that informed investment decisions can be made 
about this program. 

Mr. Chairman, this concludes my opening statement. I would be 
happy to respond to any questions at the appropriate time. 

[The prepared statement of Ms. Berrick follows:] 

Prepared Statement of Cathleen A. Berrick, Director, Homeland Security 
AND Justice Issues, U.S. Government Accountability Office 

Mr. Chairman and Members of the Committee: 

Thank you for inviting me to participate in today’s hearing on the Transportation 
Security Administration’s (TSA) Secure Flight program. The purpose of Secure 
Flight is to enable our government to protect the public and strengthen aviation se- 
curity by identifying and scrutinizing individuals suspected of having ties to ter- 
rorism, or who may otherwise pose a threat to aviation, in order to prevent them 
from boarding commercial aircraft in the United States, if warranted, or by sub- 
jecting them to additional security scrutiny prior to boarding an aircraft. The pro- 
gram also aims to reduce the number of individuals unnecessarily selected for sec- 
ondary screening while protecting passengers’ privacy and civil liberties. My testi- 
mony today presents information on the progress TSA has made and the challenges 
it faces in (1) developing, managing, and overseeing the Secure Flight program; (2) 
coordinating with Federal and private sector stakeholders who will play critical 
roles in Secure Flight operations; (3) addressing key factors that will impact system 
effectiveness; and (4) minimizing program impacts on passenger privacy and pro- 
tecting passenger rights. 

My testimony is based on our past reviews of the Secure Flight program, and on 
preliminary results from our ongoing review of 10 issues related to the development 
and implementation of Secure Flight, as mandated by Public Law 109-90, and as 
requested by eight congressional committees. ^ (See app. 1 for a description of the 
10 issues.) My testimony today updates information presented in our March 2005 
report on the status of Secure Flight’s development and implementation, ^ including 
9 of the 10 areas of congressional interest. ® In March 2006, we reported that TSA 
had made progress in developing and testing Secure Flight, but had not completed 
key system testing, had not finalized system requirements or determined how cer- 
tain aspects of the program would operate (such as the basis on which passengers 
would be selected for preflight scrutiny), and had not clearly defined the privacy im- 
pacts of the program. At the time, we recommended that TSA take several actions 
to manage the risks associated with developing and implementing Secure Flight, in- 
cluding finalizing system requirements and test plans, privacy and redress require- 
ments, and program cost estimates. 

Today, I present information that suggests that, 3 years after TSA began devel- 
oping a program to provide passenger prescreening, significant challenges remain in 
developing and implementing the Secure Flight program. The results I am pre- 
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senting are based on our review of available documentation on Secure Flight’s sys- 
tems development and oversight, policies governing program operations, and our 
past reports on the program, and interviews with Department of Homeland Security 
(DHS) officials, TSA program officials and their contractors, and other Federal offi- 
cials who are key stakeholders in the Secure Flight program. We reviewed TSA’s 
System Development Life Cycle Guidance for developing information technology sys- 
tems, and other Federal reports describing best practices in developing and acquir- 
ing these systems. We also reviewed draft TSA documents containing information 
on the development and testing of Secure Flight, including concept of operations, re- 
quirements, test plans, and test results. My testimony is based on TSA documents 
received, but does not necessarily reflect all documentation that was only recently 
made available. In addition to the TSA documents we have reviewed, we also re- 
viewed reports from the U.S. Department of Justice Office of the Inspector General 
(DOJ-OIG), which reviewed the Secure Flight program, and reports from two over- 
sight groups that provided advisory recommendations for Secure Flight: DHS’s Pri- 
vacy and Data Integrity Advisory Committee and TSA’s Aviation Security Advisory 
Committee Secure Flight Working Group. We interviewed senior-level TSA officials, 
including representatives from the Office of Transportation Threat Analysis and 
Credentialing, which is responsible for Secure Flight, and the Office of Transpor- 
tation Security Redress (OTSR), to obtain information on Secure Flight’s planning, 
development, testing, and policy decisions. We also interviewed representatives from 
the U.S. Customs and Border Protection (CBP) and Terrorist Screening Center 
(TSC)’' to obtain information about stakeholder coordination. We also interviewed 
officials from an air carrier and representatives from aviation trade organizations 
regarding issues related to Secure Flight’s development and implementation. In ad- 
dition, we attended conferences on name-matching technologies sponsored by 
MITRE (a federally funded research and development corporation) and the Office of 
the Director of National Intelligence. Our work was conducted from April 2005 to 
February 2006 in accordance with generally accepted government auditing stand- 
ards. 

Summary 

In developing and managing the Secure Flight program, TSA has not conducted 
critical activities in accordance with best practices for large-scale information tech- 
nology programs. Specifically, TSA has not followed a disciplined life cycle approach 
in developing Secure Flight, in which ah phases of the project are defined by a se- 
ries of orderly phases and the development of related documentation. Program offi- 
cials stated that they have instead used a rapid development method that was in- 
tended to enable them to develop the program more quickly. However, as a result 
of this approach, the development process has been ad hoc, with project activities 
conducted out of sequence. For example, program officials declared the design phase 
complete before requirements for designing Secure Flight had been detailed. Our 
evaluations of major Federal information technology programs, and research by oth- 
ers, has shown that following a disciplined life cycle management process decreases 
the risks associated with acquiring systems. As part of the life cycle process, TSA 
must define and document Secure Flight’s requirements — including how Secure 
Flight is to function and perform, the data needed for the system to function, how 
various systems interconnect, and how system security is achieved. We found that 
Secure Flight’s requirements documentation contained contradictory and missing in- 
formation. TSA officials have acknowledged that they have not followed a dis- 
ciplined life cycle approach in developing Secure Flight, and stated that they are 
currently rebaselining the program to follow their standard Systems Development 
Life cycle process, including defining system requirements. We also found that while 
TSA has taken steps to implement an information security management program 
for protecting Secure Flight information and assets, its efforts are incomplete, based 
on Federal standards and industry best practices. Without a completed system secu- 
rity program. Secure Flight may not be adequately protected against unauthorized 
access and use or disruption, once the program becomes operational. Finally, TSA 
is proceeding with Secure Flight development without an effective program manage- 
ment plan that contains current program schedules and cost estimates. TSA officials 
stated they have not maintained an updated schedule in part because the agency 
has not yet promulgated a necessary regulation requiring commercial air carriers 
to submit certain passenger data needed to operate Secure Flight, and air carrier 
responses to this regulation can impact when Secure Flight will be operational and 
at what cost. While we recognize that program unknowns introduce uncertainty into 
the program-planning process, uncertainty is a practical reality in planning all pro- 
grams and is not a reason for not developing plans, including cost and schedule esti- 
mates that reflect known and unknown aspects of the program. Further, several 
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oversight reviews of the program have been conducted and raise questions about 
program management, including the lack of fully defined requirements. TSA has re- 
cently taken actions that recognize the need to instill more rigor and discipline into 
the development and management of Secure Flight, including hiring a program 
manager with information systems program management credentials, and more 
completely defining system requirements and a program management plan, includ- 
ing the development of schedules and cost estimates. 

TSA has taken steps to collaborate with Secure Flight stakeholders whose partici- 
pation is essential to ensuring that passenger and terrorist watch list data are col- 
lected and transmitted for Secure Flight operations, but additional information and 
testing are needed to enable stakeholders to provide the necessary support for the 
program. TSA has, for example, drafted policy and technical guidance to help inform 
air carriers of their Secure Flight responsibilities, and has begun receiving feedback 
from the air carriers on this information. TSA is also in the early stages of coordi- 
nating with U.S. Customs and Border Protection and the Federal Terrorist Screen- 
ing Center on broader issues of integration and interoperability related to other peo- 
ple-screening programs used by the government to combat terrorism. In addition, 
TSA has conducted preliminary network connectivity testing between TSA and Fed- 
eral stakeholders to determine, for example, how information will be transmitted 
from CBP to TSA and back. However, these tests used only dummy data, and were 
conducted in a controlled environment, rather than in a real-world operational envi- 
ronment. According to CBP, without real data, it is not possible to conduct stress 
testing to determine if the system can handle the volume of data traffic that will 
be required by Secure Flight. TSA acknowledged it has not determined what the 
real data volume requirements will be, and cannot do so until the regulation for air 
carriers has been issued and their data management role has been finalized. All key 
program stakeholders also stated that additional information is needed before they 
can finalize their plans to support Secure Flight operations. A TSC official stated, 
for example, that until TSA provides estimates of the volume of potential name 
matches that TSC will be required to screen, TSC cannot make decisions about re- 
quired resources. Also, ongoing coordination of prescreening and name-matching ini- 
tiatives with CBP and TSC can impact how Secure Flight is implemented. 

In addition to collaborating with stakeholders, TSA has, over the past 11 months, 
made some progress in evaluating factors that could influence system effectiveness. 
However, several activities are under way, or are to be decided, that will also affect 
Secure Flight’s effectiveness, including operational testing to provide information 
about Secure Flight’s ability to function. TSA has been testing name-matching tech- 
nologies to determine what type of passenger data will be needed to match against 
terrorist watch list data. These tests have been conducted thus far in a controlled, 
rather than real-world environment, using historical data, but additional testing is 
needed to learn more about how these technologies will perform in an operational 
environment. In addition, due to program delays, TSA has not yet conducted com- 
prehensive end-to-end testing to verify that the entire system functions as intended, 
although it had planned to do so last summer. TSA also has not yet conducted stress 
testing to determine how the system will handle peak data volumes. In addition, 
TSA has not made key policy decisions for determining the passenger information 
that air carriers will be required to collect, the name-matching technologies that will 
be used to vet passenger names against terrorist watch list data; and thresholds 
that will be set to determine the relative volume of passengers who are to be identi- 
fied as potential matches against the database. TSA plans to finalize decisions on 
these factors as system development progresses. However, until these decisions are 
made, data requirements will remain unsettled and key stakeholders — in particular, 
air carriers — will not have the information they need to assess and plan for needed 
changes to their systems to interface with Secure Flight. On the issue of data qual- 
ity and accuracy, while the completeness and accuracy of data contained in the gov- 
ernment’s terrorist screening database can never be certain — given the varying 
quality of intelligence information gathered, and changes in this information over 
time — TSC has established some processes to help ensure the quality of these data. 
However, in a review of the TSC’s role in Secure Flight, the Department of Justice 
Office of Inspector General found that TSC could not ensure that the information 
contained in its databases was complete or accurate. According to a TSC official, 
TSA and TSC plan to enter into a letter of agreement that will describe the data 
elements from the terrorist-screening database, among other things, to be used for 
Secure Flight. To address accuracy, TSA and TSC plan to work together to identify 
false positives — passengers inappropriately matched against data contained in the 
terrorist-screening database — by using intelligence analysts to monitor the accuracy 
of data matches. An additional factor that could impact the effectiveness of Secure 
Flight in identifying known or suspected terrorists is the system’s inability to iden- 
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tify passengers who assume the identity of another individual by committing iden- 
tity theft, or who use false identifying information. Secure Flight is neither intended 
to nor designed to address these vulnerabilities. 

Because Secure Flight’s system development documentation does not fully address 
how passenger privacy protections are to be met, it is not possible to assess poten- 
tial system impacts on individual privacy protections. The Privacy Act and the Fair 
Information Practices — a set of internationally recognized privacy principles that 
underlie the Privacy Act — limit the collection, use, and disclosure of personal infor- 
mation by Federal agencies. TSA officials have stated that they are committed to 
meeting the requirements of the Privacy Act and the Fair Information Practices. 
However, it is not yet evident how this will be accomplished because TSA has not 
decided what passenger data elements it plans to collect, or how such data will be 
provided by stakeholders. Further, TSA is in the process of developing but has not 
issued the systems of records notice, which is required by the Privacy Act, or the 
privacy impact assessment, which is required by the E-Government Act, that would 
describe how TSA will protect passenger data once Secure Flight becomes oper- 
ational. Moreover, privacy requirements were not incorporated into the Secure 
Flight system development process in a manner that would explain whether per- 
sonal information will be collected and maintained in the system in a manner that 
complies with privacy and security requirements. In our review of Secure Flight’s 
system requirements, we found that privacy concerns were broadly defined in func- 
tional requirements documentation, which states that the Privacy Act must be con- 
sidered in developing the system. However, these broad functional requirements 
have not been translated into specific system requirements. TSA officials stated that 
they are completing work on integrating privacy and requirements into the Secure 
Flight system as the program is being developed, and that new privacy notices will 
be issued in conjunction with a forthcoming regulation prior to proceeing with the 
system’s initial operating capability. Until TSA finalizes these requirements and no- 
tices, however, privacy protections and impacts cannot be assessed. TSA is also de- 
termining how it will meet a congressional mandate that the Secure Flight program 
include a process whereby aviation passengers determined to pose a threat to avia- 
tion security may appeal that determination and correct erroneous information con- 
tained within the prescreening system. According to TSA officials, no final decisions 
have been made regarding how TSA will address the redress requirements, but in- 
formation on the process will be contained within the privacy notices released in 
conjunction with the forthcoming regulation. 

Background 

TSA is responsible for securing all modes of transportation while facilitating com- 
merce and the freedom of movement for the traveling public. Passenger 
prescreening is one program among many that TSA uses to secure the domestic 
aviation sector. The process of prescreening passengers — that is, determining wheth- 
er airline passengers might pose a security risk before they reach the passenger- 
screening checkpoint — is used to focus security efforts on those passengers that rep- 
resent the greatest potential threat. Currently, U.S. air carriers conduct passenger 
prescreening by comparing passenger names against government-supplied terrorist 
watch lists and applying the Computer-Assisted Passenger Prescreening System 
rules, known as CAPPS rules. ® 

Development of Legacy Passenger Prescreening Systems 

Following the events of September 11, and in accordance with the requirement 
set forth in the Aviation and Transportation Security Act that a computer-assisted 
passenger prescreening system be used to evaluate all passengers before they board 
an aircraft, ® TSA established the Office of National Risk Assessment to develop and 
maintain a capability to prescreen passengers in an effort to protect U.S. transpor- 
tation systems and the public against potential terrorists. In March 2003, this office 
began developing the second-generation computer-assisted passenger prescreening 
system, known as CAPPS II, to provide improvements over the current prescreening 
process, and to screen all passengers flying into, out of, and within the United 
States. 

Based in part on concerns about privacy and other issues expressed by us and 
others, DHS canceled the development of CAPPS II in August 2004 and shortly 
thereafter announced that it planned to develop a new passenger prescreening pro- 
gram called Secure Flight. In contrast to CAPPS II, Secure Flight, among other 
changes, will only prescreen passengers flying domestically within the United 
States, rather than passengers fljdng into and out of the United States. Also, the 
CAPPS rules will not be implemented as part of Secure Flight, but rather the rules 
will continue to be applied by commercial air carriers. Secure Flight will operate on 
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the Transportation Vetting Platform (TVP) ^ — the underl 3 dng infrastructure (hard- 
ware and software) to support the Secure Flight application, including security, com- 
monality, and data management; and, is to perform the functions associated with 
receiving, vetting, and returning requests related to the determination of whether 
passengers are on government watch lists. This application is also to be 
configurable — meaning that it can be quickly adjusted to reflect changes to workflow 
parameters. Aspects of Secure Flight are currently undergoing development and 
testing, and policy decisions regarding the operations of the program have not been 
finalized. ® 

Overview of Secure Flight Operations 

As currently envisioned, under Secure Flight, when a passenger makes flight ar- 
rangements, the organization accepting the reservation, such as the air carrier’s res- 
ervation office or a travel agent, will enter passenger name record (PNR) informa- 
tion obtained from the passenger, which will then be stored in the air carrier’s res- 
ervation system. ^ While the government will be asking for only portions of the PNR, 
the PNR data can include the passenger’s name, phone number, number of bags, 
seat number, and form of payment, among other information. Approximately 72 
hours prior to the flight, portions of the passenger data contained in the PNR will 
be sent to Secure Flight through a network connection provided by DHS’s CBP. Res- 
ervations or changes to reservations that are made less than 72 hours prior to flight 
time will be sent immediately to TSA through CBP. 

Upon receipt of passenger data, TSA plans to process the passenger data through 
the Secure Flight application running on the TVP. During this process. Secure 
Flight is to determine if the passenger data match the data extracted daily from 
TSC’s Terrorist Screening Database (TSDB) — the information consolidated by TSC 
from terrorist watch lists to provide government screeners with a unified set of ter- 
rorist-related information. In addition, TSA will screen against its own watch list 
composed of individuals who do not have a nexus to terrorism but who may pose 
a threat to aviation security, 

In order to match passenger data to information contained in the TSDB, TSC 
plans to provide TSA with an extract of the TSDB for use in Secure Flight, and pro- 
vide updates as they occur. This TSDB subset will include all individuals classified 
as either selectees (individuals who are selected for additional security measures 
prior to boarding an aircraft) or no-flys (individuals who will be denied boarding un- 
less they are cleared by law enforcement personnel). To perform the match. Se- 
cure Flight is to compare the passenger, TSDB, and other watch list data using 
automated name-matching technologies. When a possible match is generated, TSA 
and potentially TSC analysts will conduct a manual review comparing additional 
law enforcement and other government information with passenger data to deter- 
mine if the person can be ruled out as a possible match. TSA is to return the match- 
ing results to the air carriers through CBP. Figure 1 illustrates how Secure Flight 
is intended to operate. 
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Figure 1 : Planned Operation of Secure Flight 



a. Information about confirmed no-flies and certain selectees are shared with appropriate Federal agencies 
which coordinate the appropriate law enforcement response. 

As shown in figure 1, when the passenger checks in for the flight at the airport, 
the passenger is to receive a level of screening based on his or her designated cat- 
egory. A cleared passenger is to he provided a boarding pass and allowed to proceed 
to the screening checkpoint in the normal manner. A selectee passenger is to receive 
additional security scrutiny at the screening checkpoint. A no-fly passenger will 
not be issued a boarding pass. Instead, appropriate law enforcement agencies will 
be notified. Law enforcement officials will determine whether the individual will be 
allowed to proceed through the screening checkpoint or if other actions are war- 
ranted, such as additional questioning of the passenger or taking the passenger into 
custody. 

TSA Has Not Followed a Disciplined Life Cycle Approach or Fully Defined 
System Requirements, Schedule, and Costs 

TSA has not followed a disciplined life cycle approach in developing Secure Flight, 
in accordance with best practices for large-scale information technology programs. 
Following a disciplined life cycle, activities and related documentation are to be de- 
veloped in a logical sequence. TSA also has not finalized and documented functional 
and system requirements that fully link to each other and to source documents. 
Without adequately defined requirements, TSA cannot finalize a system security 
plan or develop a reliable program schedule or life cycle cost estimates. In addition 
to these concerns, other reviews that have been conducted of Secure Flight have 
raised questions about the management of the program. 

TSA Has Not Followed a Disciplined Life Cycle Process or Fully Defined System 
Requirements but Plans to Address These Issues 
Based on evaluations of major Federal information technology programs like Se- 
cure Flight, and research by others, following a disciplined life cycle management 
process in which key activities and phases of the project are conducted in a logical 
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and orderly process and are fully documented, helps ensure that programs achieve 
intended goals within acceptable levels of cost and risk. Such a life cycle process 
begins with initial concept definition and continues through requirements deter- 
mination to final testing, implementation, and maintenance. TSA has established a 
System Development Life Cycle (SDLC) that defines a series of orderly phases and 
associated steps and documentation. The SDLC serves as the mechanism to ensure 
that systems are effectively managed and overseen. Figure 2 provides a description 
of TSA’s SDLC phases and related documentation. 


Figure 2: Summary of TSA’s System Development Life Cycle Process 


Phase Related documentation 



Sower GAO anafrM- 

TSA has not followed its SDLC in developing and managing Secure Flight. Rath- 
er, program officials stated that they have used a rapid development method that 
was intended to enable them to develop the program more quickly. However, these 
officials could not provide us with details on how this approach was implemented. 
As a result, our analysis of steps performed and documentation developed indicates 
that Secure Flight has not been pursued within the context of a logical, disciplined, 
system development methodology. Rather the process has been ad hoc, with project 
activities conducted out of sequence. For example, program officials declared that 
the program’s design phase was completed before system requirements had been 
adequately detailed, and key activities have yet to be adequately performed, such 
as program planning and defining system requirements. TSA officials acknowledged 
that problems arose with Secure Flight as a result of using this approach. As a re- 
sult, it is currently unclear what Secure Flight capabilities are to be developed, by 
when, at what cost, and what benefits are to accrue from the program. Without clar- 
ification on these decision points, the program is at risk of failure. 

Defining and documenting system requirements is integral to life cycle develop- 
ment. Based on best practices and our prior work in this area, the expected capabili- 
ties of a system such as Secure Flight should be defined in terms of requirements 
for functionality (what the system is to do), performance (how well the system is 
to execute functions), data (what data are needed by what functions, when, and in 
what form), interface (what interactions with related and dependent systems are 
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needed), and security. Further, system requirements should be unambiguous, con- 
sistent with one another, linked (that is, traceable from one source level to an- 
other), verifiable, understood by stakeholders, and fully documented. 

TSA has prepared certain Secure Flight requirements documents, and officials 
stated that they are now reviewing those requirements documents. We support 
these review efforts because we found, in the requirements documents we reviewed, 
inconsistencies and ambiguities in requirements documentation for system func- 
tions, performance, data, and security — and that these documents were not always 
complete. For example, according to TSA’s SDLC guidance and best practices for de- 
veloping information technology systems, systems like Secure Flight should have a 
comprehensive concept of operations covering all aspects of the program during the 
planning phase (see fig. 2). We reported in our March 2005 report that TSA had 
not yet finalized a concept of operations, which would describe conceptually the full 
range of Secure Flight operations and interfaces with other systems, and we rec- 
ommended that it develop one. Since March 2005, TSA documents refer to numer- 
ous concept of operations, such as a long concept of operations, a short concept of 
operations, and an initial operational capability concept of operations. TSA provided 
a June 2005 concept of operations for our review, but this document does not con- 
tain key system requirements, such as the high-level requirements for security and 
privacy. 

In addition, we found that Secure Flight requirements were unclear or missing. 
For example, while the requirements that we reviewed state that the system be 
available 99 percent of the time, this only covers the TVP and Secure Flight applica- 
tion. It does not include requirements for the interfacing systems critical for Secure 
Flight operations. Thus, the availability requirements for all of the components of 
the Secure Flight system are not yet known. Some data requirements are also vague 
or incomplete; for example, one data requirement is that the data is current, but 
the meaning of current is not defined. In addition, only some system security re- 
quirements are identified in the security document provided to us for the TVP, and 
sections in TSA’s Systems Requirements Specification contain only placeholder 
notes — “to be finalized” — for security and privacy requirements. 

TSA officials acknowledged that it is important that requirements be traceable to 
ensure that they are consistently, completely, and correctly defined, implemented, 
and tested. To help accomplish this, TSA officials stated that they use a require- 
ments tracking tool for Secure Flight that can align related requirements to dif- 
ferent documents, and thus establish traceability (e.g., it can map the Systems Re- 
quirements Specification to a functional requirements document). According to pro- 
gram officials, this tool can also be used for aligning and tracing requirements to 
test cases (i.e., scenarios used to determine that the system is working as intended). 
We found, however, that requirements for Secure Flight have not been fully traced. 
For example, we were not able to trace system capabilities in contractual documents 
to the concept of operations and then to the various requirement documents, to de- 
sign phase use cases, and to test cases. In addition, contractor staff we interviewed 
stated that they were unable to use this tool to align or trace necessary require- 
ments without the aid of supplemental information. Without internal alignment 
among system documentation relating to requirements, there is not adequate assur- 
ance that the system produced will perform as intended. 

In addition, we found that available Secure Flight requirements documents did 
not define the system’s boundaries, including interfaces, for each of the stake- 
holders — that is, the scope of the system from end to end, from an air carrier to 
CBP, to TSA, to TSC, and back to TSA, then again to CBP and air carriers (refer 
to fig. 1 for an overview of this process). Defining a system’s boundaries is important 
in ensuring that system requirements reflect all of the processes that must be exe- 
cuted to achieve a system’s intended purpose. According to TSA’s SDLC guidance, 
a System Boundary Document is to be developed early in the system life cycle. How- 
ever, in its third year of developing a passenger prescreening system, TSA has not 
yet prepared such a document. Although the System Boundary Document was not 
available, the program’s Systems Security Document does refer to an “accreditation 
boundary,” which defines the Secure Flight system from the standpoint of system 
security accreditation and certification. According to this definition of what Secure 
Flight includes, those systems that are needed to accomplish Secure Flight program 
goals (e.g., those of commercial air carriers, CBP, and TSC) are not part of Secure 
Flight. If the boundary documents, and thus the requirements, do not reflect all sys- 
tem processes and connections that need to be performed, the risk is increased that 
the system will not achieve Secure Flight’s intended purpose. Moreover, until all 
system requirements have been defined, TSA will not be able to stress-test Secure 
Flight in an operational, end-to-end mode. In our March 2005 report, we rec- 
ommended that TSA finalize its system requirements documents and ensure that 
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these documents address all system functionality. Although TSA agreed with our 
recommendations, the requirements documentation that we reviewed showed that 
the agency has not yet completed these activities. 

Our evaluations of major Federal information technology programs, and research 
by others, has shown that following a disciplined life cycle management process de- 
creases the risks associated with acquiring systems. The steps and products in the 
life cycle process each have important purposes, and they have inherent depend- 
encies among themselves. Thus, if earlier steps and products are omitted or defi- 
cient, later steps and products will be affected, resulting in costly and time-con- 
suming rework. For example, a system can be effectively tested to determine wheth- 
er it meets requirements only if these requirements have already been fully defined. 
Concurrent, incomplete, and omitted activities in life cycle management exacerbate 
the program risks. Life cycle management weaknesses become even more critical as 
the program continues, because the size and complexity of the program will likely 
only increase, and the later problems are found, the harder and more costly they 
will likely be to fix. 

In October 2006, Secure Flight’s director of development stated in a memorandum 
to the assistant TSA administrator responsible for Secure Flight that by not fol- 
lowing a disciplined life cycle approach, in order to expedite the delivery of Secure 
Flight, the government had taken a calculated risk during the requirements defini- 
tion, design, and development phases of the program’s life cycle development. The 
director stated that by prioritizing delivery of the system by a specified date in lieu 
of delivering complete documentation, TSA had to lower its standards of what con- 
stituted acceptable engineering processes and documentation. Since then, TSA offi- 
cials stated that the required system documentation associated with each phase of 
the TSA life cycle is now being developed to catch up with development efforts. In 
addition, TSA recognized that it faces challenges preparing required systems docu- 
mentation, and to help in this regard it has recently hired a certified systems pro- 
gram manager to manage systems development. In January 2006, this program 
manager stated that as Secure Flight moves forward, TSA’s SDLC would be fol- 
lowed in order to instill greater rigor and discipline into the system’s development. 
In addition, TSA plans to hire a dedicated program director for Secure Flight to 
manage program activities, schedules, milestones, costs, and program contractors, 
among other things. 

Comprehensive System Security Management Program Has Not Yet Been Established 
in Accordance with Federal Guidance 

TSA has taken steps to implement an information system security management 
program for protecting Secure Flight information and assets. Secure Flight’s secu- 
rity plans and the related security review, which TSA developed and conducted to 
establish authority to operate, are important steps in the system’s development. 
However, the steps related to system security TSA has taken to date are individ- 
ually incomplete, and collectively fall short of a comprehensive system security man- 
agement program. Federal guidance and industry best practices describe critical ele- 
ments of a comprehensive information system security management program. With- 
out effective system security management, it is unlikely that Secure Flight will, for 
example, be adequately protected against unauthorized access and use, disruption, 
modification, and destruction. 

According to National Institute of Standards and Technology (NIST) and Office 
of Management and Budget (0MB) guidance under the Federal Information Secu- 
rity Management Act, as well as industry best practices, a comprehensive system 
security management program includes (1) conducting a system wide risk assess- 
ment that is based on system threats and vulnerabilities, (2) developing system se- 
curity requirements and related policies and procedures that govern the operation 
and use of the system and address identified risks, (3) certifying that the system 
is secure based on sufficient review and testing to demonstrate that the system 
meets security requirements, and (4) accrediting the system as secure in an oper- 
ational setting. 

TSA has developed two system security plans — one for the TVP and one for the 
Secure Flight application. However, neither of these plans nor the security activities 
that TSA has conducted to date are complete. For example, while security threats 
and vulnerabilities were assessed in the documentation and risks were identified in 
risk assessments, requirements to address these risks were only partially defined 
in the security plan for the TVP, and they were not included at all in the plan for 
the Secure Flight application. In addition, the sections on security requirements and 
privacy requirements in the System Requirements Specification document read “to 
be finalized” with no further description. 
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Moreover, we also found that the security systems plans did not reflect the cur- 
rent level of risk designated for the program. For example, although the July 15, 
2005, System Security Plan for the TVP arrived at an overall assessment of its ex- 
posure to risks as being “medium,” an August 23, 2005, requirements document 
found that the security risk level for the TVP was “high.” As a system moves from 
a medium to a high level of risk, the security requirements become more stringent. 
TSA has not provided us with an updated System Security Plan for the TVP that 
addressed this greater level of risk by including additional NIST requirements for 
a high-risk system. In addition, this TVP System Security Plan included only about 
40 percent of the NIST requirements associated with a medium-risk system. With- 
out addressing all NIST requirements, in addition to those required for a high-risk 
system, TSA may not have proper controls in place to protect sensitive information. 

According to Federal guidance and requirements, the determination and approval 
of the readiness of a system to securely operate is accomplished via a certification 
and accreditation process. On September 30, 2005, the TSA assistant administrator 
responsible for Secure Flight formally granted authority, based on certification and 
accreditation results, for the TVP and the Secure Flight application to operate, 
However, the team performing the certification found that TSA was unsure whether 
they tested all components of the security system for the TVP and the Secure Flight 
application, because TSA lacked an effective and comprehensive inventory system. 
Therefore the certification team could not determine whether its risk assessments 
were complete or accurate. This team also documented 62 security vulnerabilities 
for the Secure Flight application and 82 security vulnerabilities for the TVP. The 
certification team recommended authority to operate on the condition that corrective 
action or obtaining an exemption for the identified vulnerabilities would be taken 
within 90 days or the authority to operate would expire. TSA officials stated that 
these vulnerabilities had been addressed except for three that are being reviewed 
in a current security audit. 

Program Management Plan and Supporting Schedules and Cost Estimates for 
Secure Flight Have Not Been Maintained 

TSA has proceeded with Secure Flight development over the past year without a 
complete and up-to-date program management plan, and without associated cost 
and schedule estimates showing what work will be done by whom, at what cost, and 
when. A program management plan can be viewed as a central instrument for guid- 
ing program development. Among other things, the plan should include a breakout 
of the work activities and products that are to be conducted in order to deliver a 
mission capability to satisfy stated requirements and produce promised mission re- 
sults. This information, in turn, provides the basis for determining the time frames 
and resources needed for accomplishing this work, including the basis for mile- 
stones, schedules, and cost estimates. TSA has not provided us with either the com- 
plete and up-to-date program management plan, or an estimated schedule and costs 
for Secure Flight. According to a TSA official, an updated program management 
plan is currently being developed and is about 90 percent complete. 

In lieu of a program management plan with a schedule and milestones, TSA has 
periodically disclosed program milestones. However, the basis for and meaning of 
these milestones have not been made clear, and TSA’s progress in meeting these 
milestones has not been measured and disclosed. TSA’s SDLC and 0MB guidance 
require that programs like Secure Flight provide risk-adjusted schedule goals, in- 
cluding key milestones, and that programs demonstrate satisfactory progress toward 
achieving their stated performance goals. In March 2005, we reported that the mile- 
stone that TSA set for achieving initial operating capability for Secure Flight had 
slipped from April 2005 to August 2005. TSA officials stated that TSA revised this 
milestone to state that instead of achieving initial operating capability, it would 
begin operational testing. This new milestone subsequently slipped first to Sep- 
tember 2005, then to November 2005. Since that time, the program has not yet 
begun operational testing or initial operations, and TSA has not yet produced an 
updated schedule identifying when program operations will begin or when other key 
milestones are to be achieved to guide program development and implementation. 
Further, while agency officials stated that they are now planning for operational 
testing of an unspecified capability, no milestone date has been set for doing so. 

TSA officials stated that they have not maintained an updated program schedule 
for Secure Flight in part because the agency has not yet determined the rulemaking 
approach it will pursue for requiring commercial air carriers to submit certain pas- 
senger data needed to operate Secure Flight, among other things. Specifically, TSA 
officials stated that a schedule with key milestones, such as operational testing, can- 
not be set until after air carriers have responded to the rulemaking and provided 
their plans and schedules for participating in Secure Flight. The rulemaking has 
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been pending since the spring of 2005, and the rule remains in draft form and is 
under review, according to TSA officials. Once the rule has been issued, TSA offi- 
cials stated that air carriers will be given time to respond with their plans and 
schedules. TSA officials further stated that until this occurs, and a decision is made 
as to how many air carriers will participate in a yet-to-be-defined initial phase of 
the program (they are expected to begin incrementally), a program schedule cannot 
be set. 

Further, TSA has not yet established cost estimates for developing and deploying 
either an initial or a full operating capability for Secure Flight, and it has not devel- 
oped a life-cycle cost estimate (estimated costs over the expected life of a program, 
including direct and indirect costs and costs of operation and maintenance). TSA 
also has not updated its expenditure plan — plans that generally identify near-term 
program expenditures — to reflect the cost impact of program delays, estimated costs 
associated with obtaining system connectivity with CBP, or estimated costs expected 
to be borne by air carriers. Program and life cycle cost estimates are critical compo- 
nents of sound program management for the development of any major investment. 
Developing cost estimates is also required by 0MB guidance and can be important 
in making realistic decisions about developing a system. Expenditure plans are de- 
signed to provide lawmakers and other officials overseeing a program’s development 
with a sufficient understanding of the system acquisition to permit effective over- 
sight, and to allow for informed decision making about the use of appropriated 
funds. 

In our March 2005 report, we recommended that TSA develop reliable life cycle 
cost estimates and expenditure plans for the Secure Flight program, in accordance 
with guidance issued by 0MB, in order to provide program managers and oversight 
officials with the information needed to make informed decisions about program de- 
velopment and resource allocations. Although TSA agreed with our recommendation, 
it has not yet provided this information. TSA officials stated that developing pro- 
gram and life cycle cost estimates for Secure Flight is challenging because no simi- 
lar programs exist from which to base cost estimates and because of the uncertain- 
ties surrounding Secure Flight requirements. Further, they stated that cost esti- 
mates cannot be accurately developed until after system testing is completed and 
policy decisions have been made regarding Secure Flight requirements and oper- 
ations. Notwithstanding these statements, TSA officials stated that they are cur- 
rently assessing program and life cycle costs as part of their rebaselining and that 
this new baseline will reflect updated cost, funding, scheduling, and other aspects 
of the program’s development. 

While we recognize that program unknowns introduce uncertainty into the pro- 
gram-planning process, including estimating tasks, time frames, and costs, uncer- 
tainty is a practical reality in planning all programs and is not a reason for not de- 
veloping plans, including cost and schedule estimates, that reflect known and un- 
known aspects of the program. In program planning, assumptions need to be made 
and disclosed in the plans, along with the impact of the associated uncertainty on 
the plans and estimates. As more information becomes known over the life of the 
program, these plans should be updated to recognize and reflect the greater con- 
fidence in activities that can be expressed with estimates. 

Program management plans and related schedules and cost estimates — based on 
well-defined requirements — are important in making realistic decisions about a sys- 
tem’s development, and can alert an agency to growing schedule or cost problems 
and the need for mitigating actions. Moreover, best practices and related Federal 
guidance emphasize the need to ensure that programs and projects are implemented 
at acceptable costs and within reasonable and expected time frames. Investments 
such as Secure Flight are approved on the expectation that programs and projects 
will meet certain commitments to produce certain capabilities and benefits (mission 
value) within the defined schedule and cost. Until an updated program management 
plan and related schedules and cost estimates and expenditure plans, are prepared 
for Secure Flight — which should be developed despite program uncertainties, and 
updated as more information is gained — TSA and Congress will not be able to pro- 
vide complete oversight over the program’s progress in meeting established commit- 
ments. 

Oversight Reviews of Secure Flight Have Been Conducted and Raised Questions 
about Program Management 

DHS and TSA have executive and advisory oversight mechanisms in place to over- 
see Secure Flight. As we reported in March 2005, the DHS Investment Review 
Board (IRB) — designed to review certain programs at key phases of development to 
help ensure they meet mission needs at expected levels of costs and risks — reviewed 
the TVP from which Secure Flight will operate, in January 2006. As a result of 
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this review, the board withheld approval for the TVP to proceed from development 
and testing into production and deployment until a formal acquisition plan, a plan 
for integrating and coordinating Secure Flight with other DHS people-screening pro- 
grams, and a revised acquisition program baseline (cost, schedule, and performance 
parameters) had been completed. Since that time, TSA has not yet addressed these 
conditions and has not obtained approval from the IRB to proceed into production. 
DHS officials stated that an IRB review is scheduled to be held in March 2006 — 
14 months after the IRB last met to examine Secure Flight — to review Secure Flight 
and other people-screening programs, including international prescreening con- 
ducted by CBP. Specifically, the board will review the acquisition strategy and 
progress for each program, focusing, in part, on areas of potential duplication. Ac- 
cording to TSA officials, the agency intends to establish a new program cost, sched- 
ule, and capability baseline for Secure Flight, which will be provided to the IRB for 
review. 

DHS’s Data Privacy and Integrity Advisory Committee also reviewed Secure 
Flight during the last year, Committee Members have diverse expertise in pri- 
vacy, security, and emerging technology, and come from large and small companies, 
the academic community, and the nonprofit sector. In December 2005, the com- 
mittee issued five recommendations on key aspects of the program, including rec- 
ommendations designed to minimize data collection and provide an effective redress 
mechanism to passengers who believe they have been incorrectly identified for addi- 
tional security scrutiny. TSA officials stated that they are considering the advisory 
committees’ findings and recommendations as part of their rebaselining efforts. 

In September 2004, TSA appointed an independent working group within the 
Aviation Security Advisory Committee, composed of government privacy and secu- 
rity experts, to review Secure Flight. The working group issued a report in Sep- 
tember 2005 that concluded, among other things, that TSA had not produced a com- 
prehensive policy document for Secure Flight that could define oversight or govern- 
ance responsibilities, nor had it provided an accountability structure for the pro- 
gram. The group attributed this omission to the lack of a program-level policy docu- 
ment issued by a senior executive, which would clearly state program goals. The 
working group also questioned Secure Flight’s oversight structure and stated that 
it should focus on the effectiveness of privacy aspects of the program and, in doing 
so, consider oversight regimes for Federal law enforcement and U.S. intelligence ac- 
tivities. 

In addition to oversight reviews initiated by DHS and TSA, the DOJ-OIG issued 
a report in August 2005 reviewing TSC’s role in supporting Secure Flight. In its 
report, the DOJ-OIG reported that TSC faced several key factors that were un- 
known with respect to supporting Secure Flight, including when the program will 
begin, the volume of inquiries it will receive, the number of TSC resources required 
to respond to these inquiries, and the quality of the data it will have to analyze. 
In light of these findings, the DOJ-OIG report recommended that, among other 
things, TSC better prepare itself for future needs related to Secure Flight by 
strengthening its budgeting and staffing processes and by improving coordination 
with TSA on data exchange standards. In June 2005, a DOJ-OIG report rec- 
ommended that TSC conduct a record-by-record review of the TSDB to improve 
overall data quality and integrity. TSC agreed with all recommendations made. 

TSA Has Made Progress in Coordinating With Critieal Stakeholders hut 
More Work Remains 

TSA has drafted policy and technical guidance to help inform air carriers of their 
Secure Flight responsibilities, and has begun coordinating with CBP and TSC on 
Secure Flight requirements and broader issues of integration and interoperability 
between Secure Flight and other people-screening programs. However, TSA has not 
yet provided information and technical requirements that all stakeholders need to 
finalize their plans to support the program’s operations, and to adequately plan for 
the resources needed to do so. 

TSA Has Begun Collaborating With Key Stakeholders, but Their Participation Will 
Be Limited Until System Requirements Have Been Finalized 

As we reported in March 2005, key Federal and commercial stakeholders — CBP, 
TSC, and commercial air carriers — will play a critical role in the collection and 
transmission of data needed for Secure Flight to operate successfully. Accordingly, 
TSA will need to ensure that requirements for each stakeholder are determined. For 
instance, TSA will need to define how air carriers are to connect to CBP and what 
passenger data formats and structures will be used. Although more remains to be 
done, TSA has worked to communicate and coordinate requirements with stake- 
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holders. For example, TSA has maintained weekly communications with CBP and 
TSC regarding their roles and responsibilities related to Secure Flight operations. 

TSA has also begun to address air carriers’ questions about forthcoming Secure 
Flight requirements. For example, TSA Officials have produced draft air carrier 
guidance, known as the Secure Flight Data Transmission Plan Guidance (DTPG). 
The final DTPG is to include guidance to air carriers addressing the following areas: 
Secure Flight’s mission overview and objectives, project planning phases, aircraft op- 
erator operations and airport procedures, technical data requirements, aircraft oper- 
ator application development. Secure Flight operations, and system maintenance 
and support. According to TSA officials, air carriers have received copies of a partial 
draft D'TPG, and some air carriers have submitted feedback to Secure Flight’s Air- 
line Implementation and Operations Team that TSA says it is working to address. 

In addition to drafting guidance, TSA has conducted preliminary network 
connectivity testing between TSA and Federal stakeholders. For example, messages 
have been transmitted from CBP to TSA and back. However, such tests included 
only dummy data. According to CBP officials, no real-time passenger data have been 
used in this testing, and system stress testing has not yet been conducted. With- 
out real-time passenger data, the official said, CBP cannot estimate total capacity 
or conduct stress testing to ensure the system operates effectively. Further, accord- 
ing to a TSC official, testing has been conducted to show that a data exchange be- 
tween the TSC and TSA is functioning, but the system has not been stress-tested 
to determine if it can handle the volume of data traffic that will be required to oper- 
ate Secure Flight. According to this official, TSA has not specified what these data 
volume requirements will be. TSA officials acknowledged that they have not yet 
made this determination and stated that they will not be able to do so until they 
(1) issue the rule, and (2) have received the air carrier plans for participating in 
Secure Flight based on requirements identified in the rule. 

Although CBP, TSC, and air carrier officials we interviewed acknowledged TSA’s 
outreach efforts, they cited several areas where additional information was needed 
from TSA before they could fully support Secure Flight. Several CBP officials stated, 
for example, that they cannot proceed with establishing connectivity with all air car- 
riers until DHS publishes the rule — the reflation that will specify what type of in- 
formation is to be provided for Secure Flight — and the air carriers provide their 
plans for providing this information. Similarly, a TSC official stated that TSC can- 
not make key decisions on how to support Secure Flight until TSA provides esti- 
mates of the volume of potential name matches that TSC will be required to screen, 
as identified above. The TSC official stated that without this information, TSC can- 
not make decisions about required resources, such as personnel needed to operate 
its call center, As we reported in March 2005, air carriers also expressed concerns 
regarding the uncertainty of the Secure Flight system and data requirements, and 
the impact these requirements may have on the airline industry and traveling pub- 
lic. Air carriers will not be able to begin to modify their passenger data systems to 
record the data attributes — such as full name and date of birth, which Secure Flight 
will use to conduct name matching — until TSA determines and communicates which 
specific data attributes are to be used. 

Oversight groups that have reviewed Secure Flight agreed that additional work 
was needed to improve the flow of information to, and coordination with, program 
stakeholders. In its December 2005 report on Secure Flight, the DHS Data Privacy 
and Integrity Advisory Committee stated that TSA needs to be clear with air car- 
riers about what information it needs now and what information it may consider 
requesting in the future, to enable air carriers to avoid sequential revisions of data- 
handling systems. Also, in September 2005, the Aviation Security Advisory Com- 
mittee working group expressed concerns about the lack of clarity regarding how Se- 
cure Flight will interact with other screening programs. 

Further, in its August 2005 audit of TSC’s support of Secure Flight, the DOJ- 
OIG reported that TSC officials believed that their ability to prepare for the imple- 
mentation of Secure Flight has been hampered by TSA’s failure to make, commu- 
nicate, and comply with key program and policy decisions in a timely manner, such 
as the launch date and volume of screening to be conducted during initial implemen- 
tation. In addition, the report noted that because TSA is unsure about how many 
air carriers will participate in the initial phase of the program, neither TSA nor 
TSC can know how many passenger records will be screened, and cannot project the 
number of watch list hits that will be forwarded to the TSC for action. Finally, the 
DOJ-OIG report concluded that the shifting of critical milestones — including TSA’s 
schedule slippages over the past year — has affected TSC’s ability to adequately plan 
for its role in Secure Flight. 

Despite TSA’s outreach efforts, stakeholder participation in Secure Flight is de- 
pendent on TSA’s effort to complete its definition of requirements and describe these 
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in the rule. Because TSA has not fully defined system requirements, key stake- 
holders have not been able to fully plan for or make needed adjustments to their 
systems. In our March 2005 report, we recommended that TSA develop a plan for 
establishing connectivity among the air carriers, CBP, and TSC to help ensure the 
secure, effective, and timely transmission of data for use in Secure Flight oper- 
ations. Although TSA has continued to coordinate with these key stakeholders, at 
present the agency has still not completed the plans and agreements necessary to 
ensure the effective support of Secure Flight. 

Ongoing Coordination of Prescreening and Name-Matching Initiatives Can Impact 
How Secure Flight Is Implemented 

In January 2006, TSA officials stated that they are in the early stages of coordi- 
nating with CBP on broader issues of integration and interoperability related to 
other people-screening programs. These broader coordination efforts, which are fo- 
cused on minimizing duplicative efforts that may exist between the agencies that 
screen individuals using watch list data and achieving synergies and efficiencies, 
are important because they may affect how Secure Flight will operate initially and 
in the future. Specifically, TSA Officials stated that they are coordinating more 
closely with CBP’s international prescreening initiatives for passengers on flights 
bound for the United States. The Air Transport Association and the Association of 
European Airlines — organizations representing air carriers — had requested, among 
other things, that both domestic and international prescreening function through co- 
ordinated information connections and avoid unnecessary duplication of communica- 
tions, programming, and information requirements. 

In response to air carrier concerns, and the initiatives of DHS to minimize dupli- 
cative efforts, officials from both CBP and TSA explained that they are beginning 
to work together to ensure that air carriers have a single interface with the govern- 
ment for prescreening both domestic and international passengers. TSA and CBP 
officials further stated that they will try to use CBP’s network to transmit domestic 
and international passenger data to and from the air carriers, thus providing the 
air carriers with a single interface for sending and receiving information. TSA and 
CBP officials also stated that air carriers should receive a common notification 
about whether a passenger — domestic or international — requires normal processing, 
additional screening, or is not permitted to board a plane. However, according to 
these officials, TSA and CBP have not yet resolved other system differences — such 
as the fact that their prescreening systems use different passenger data elements, 
documentation, and name matching technologies — that could lead to conflicting 
notifications that would instruct air carriers to handle a passenger differently for 
an international than for a domestic flight. Both TSA and CBP officials agreed that 
additional coordination efforts are needed to resolve these differences, and stated 
that they plan to work closely together in developing a prescreening capability for 
both domestic and international passengers. Decisions made as a result of further 
coordination could result in changes to the way that Secure Flight is implemented. 

In addition to coordinating with CBP on international prescreening, TSA faces ad- 
ditional coordination challenges working with TSC. Specifically, according to TSC of- 
ficials, TSC has an initiative under way to, among other things, better safeguard 
watch list data. Currently, TSC exports watch list data to other Federal agencies, 
such as TSA and the State Department, for use in these agencies’ screening efforts 
or processes for examining documents and records related to terrorism. However, 
TSC is currently developing a new system whereby watch list data would not be 
exported, but rather would be maintained by TSC. This system, called Query, is to 
serve as a common shared service that will allow agencies to directly search the 
TSDB using TSC’s name matching technology for their own purposes. TSC has con- 
ducted limited testing of the system. If TSC chooses to use Query, TSA will be re- 
quired to modify the system architecture for Secure Flight in order to accommodate 
the new system. According to a TSC official, this effort could be costly. While TSA 
acknowledged in its draft concept of operations plan in June 2005 that Secure Flight 
would need to be modified to accommodate TSC’s Query “as necessary,” the agency 
has not made adjustments to its system requirements or conducted a cost analysis 
of expected impacts on the Secure Flight program. Rather, TSA has decided that 
it will continue developing the Secure Flight application, which includes TSA’s 
name-matching technologies. Thus, TSC will need to export watch list data to TSA 
to support Secure Flight, once it becomes operational. 

Key Factors That Will Influence the Effectiveness of Secure Flight Have 
Not Been Finalized or Resolved 

Several activities are under way, or are to be decided, that will affect Secure 
Flight’s effectiveness, including how operational testing is conducted, and how data 
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requirements and data accuracy are determined. TSA has been testing and evalu- 
ating name-matching technologies for determining what type of passenger data will 
be needed to match against the TSDB. These tests have been conducted thus far 
in a controlled, rather than real-world environment, using historical data, and addi- 
tional testing is needed. In addition, TSA has not made key decisions regarding how 
the name-matching technologies to be used by Secure Flight will operate or which 
data will be used to conduct name matching. While TSA is not responsible for en- 
suring the accuracy of passenger data, the agency must nonetheless advise stake- 
holders on data accuracy and quality requirements. Another factor that could im- 
pact the effectiveness of Secure Flight in identifying known or suspected terrorists 
is the system’s inability to identify passengers who assume the identity of another 
individual by committing identity theft, or passengers who use false identifying in- 
formation. Secure Flight is neither intended to nor designed to address these 
vulnerabilities. 

Tests of Name-Matching Capability Are Under Way, but Full System Testing Has 
Not Yet Been Conducted 

TSA has tested — and continues to test — the effectiveness of one aspect of the Se- 
cure Flight system, namely name-matching technologies. These name-matching 
tests will help TSA determine what passenger data will be needed for the system 
to match most effectively passenger records with information contained in the 
TSDB. These tests are critical to defining data requirements and making decisions 
about how to configure the name-matching technologies. Additional tests will need 
to be conducted in an operational, real-world environment to fully understand how 
to configure the system effectively. This is because the name-matching tests con- 
ducted to date were conducted in a controlled, rather than real-world, environ- 
ment — that is, under controlled, or simulated, conditions. For example, TSA used 
historic air carrier passenger data from June 2004 and historic and simulated watch 
list data to test the functionality and effectiveness of Secure Flight’s name-matching 
technologies that match air carrier passenger records with potential terrorists in the 
TSDB. 

Additional testing beyond name-matching also needs to be conducted, after TSA 
rebaselines its program, defines system requirements, and begins adhering to its 
SDLC. For example, stress and operational testing^® would help determine whether 
Secure Flight can process the volume of data expected and operate as intended in 
an operational environment. As we reported in March 2005, TSA had planned to 
conduct a series of operational tests consisting of increasingly larger increments of 
the system’s functionality until the complete system was tested. These tests were 
to begin in June 2005. However, due to program delays, TSA has not yet conducted 
this end-to-end testing needed to verify that the entire system, including any inter- 
faces with external systems, functions as intended in an operational environment. 
TSA also has not yet conducted the stress testing needed to measure the system’s 
performance and availability in times of particularly heavy (i.e., peak) loads. Re- 
cently, TSA documented its overall strategy for conducting these tests and developed 
draft test plans. TSA officials stated that information about its plans for future test- 
ing will be included in its rebaselined program plan. Until this testing is complete, 
it will not be possible to determine whether Secure Flight will function as intended 
in an operational environment. 

Key Policy Decisions That Will Impact System Effectiveness Have Not Been Made 

Key policy decisions that will influence the effectiveness of Secure Flight in identi- 
fying passengers who should undergo additional security scrutiny have not yet been 
made. These policy decisions include (1) determining the passenger information that 
air carriers will be required to collect and provide for vetting, (2) the name-matching 
technologies that will be used to vet passenger data against data contained in the 
TSDB, and (3) the thresholds that will be set to determine when a passenger will 
be identified as a potential match against the TSDB. These three decisions, dis- 
cussed below, are all critical to ensuring that Secure Flight identifies potential ter- 
rorist threats as effectively as possible while minimizing the number of potential 
matches that will require further review by TSA and TSC analysts. 

(1) Determining the passenger information that air carriers will be required to col- 
lect and provide for vetting: TSA needs to decide which data attributes air carriers 
will be required to provide in passenger data to be used to match against data con- 
tained in the TSDB, such as full first, middle, and last name plus other discrete 
identifiers, such as date of birth. 

Using too many data attributes can increase the difficulty of matching, since the 
risk of errors or mismatches increases. Using too few attributes can create an un- 
necessarily high number of incorrect matches due to, among other things, the dif- 
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ficulty of differentiating among similar common names without using further infor- 
mation. Initial TSA test results have shown that the use of name and date of birth 
alone might not be sufficient for decreasing the number of false positives — that is, 
passengers inappropriately matched against data contained in the TSDB. 

(2) Selecting name-matching technologies used to vet passenger names against the 
TSDB: TSA must determine what type or combination of name-matching tech- 
nologies to acquire and implement for Secure Flight, as these different technologies 
have different capabilities. For example, TSA’s PNR testing showed that some 
name-matching technologies are more capable than others at detecting significant 
name modifications, which allows for the matching of two names that contain some 
variation. Detecting variation is important because passengers may intentionally 
make alterations to their names in an attempt to conceal their identity. Also, unin- 
tentional variations can result from different translations of nonnative names or 
data entry errors. For example, some name-matching technologies might correctly 
discriminate between “John Smith” and “John Smythe,” others may not. However, 
name matching technologies that are best at detecting name variations may also in- 
crease the number of potential matches that will have to be further reviewed, which 
could be offset using a combination of name matching technologies. TSA officials 
stated in November 2005 that it planned to continuously evaluate the best name- 
matching technologies or combination of technologies to enhance the system in fu- 
ture iterations. TSA officials recently stated that they had made, but not yet docu- 
mented, an initial determination regarding the name-matching technologies that 
will be used for Secure Flight and that they plan to conduct continuous reviews of 
the name-matching technologies to address circumstances as they arise. 

(3) Selecting thresholds for determining when a possible name match has oc- 
curred: TSA has discretion to determine what constitutes a possible match between 
a passenger’s data and a TSDB record. For each name that is matched, the name- 
matching tool will assign a numeric score that indicates the strength of the poten- 
tial match. 32 For example, a score of 95 out of 100 would indicate a more likely 
match than a score of 85. If TSA were to set the threshold too high, many names 
may be cleared and relatively few flagged as possible matches — that is, there is a 
possibility that terrorists’ names may not be matched. Conversely, if the threshold 
were set too low, passengers may be flagged unnecessarily, and relatively few 
cleared through the automated process. As an example of the importance of setting 
thresholds, during one of the PNR tests conducted, TSA set the name-matching 
threshold at 80, which resulted in over 60 percent of passengers requiring manual 
review. Alternatively, when TSA set the threshold at 95, less than 5 percent of the 
same group of passenger records were identified as requiring further review. With 
about 1.8 million passengers traveling domestically per day, having a threshold that 
is too low could produce an unmanageable number of matches — possibly leading to 
passenger delays — while setting the threshold too high could result in the system 
missing potential terrorists. Although TSA will not decide how the thresholds 
should be set until it conducts additional evaluations, it has indicated that the 
threshold might be adjusted to reflect changes in the terrorist threat level. This 
would result in Secure Flight flagging more names for potential manual review in 
order to ensure greater scrutiny in response to changing conditions. 

TSA plans to finalize decisions on these factors as system development progresses. 
However, until these decisions are made, requirements will remain unsettled and 
key stakeholders — in particular air carriers — will not have the information they 
need to assess and plan for changes to their systems necessary for interfacing with 
Secure Flight. Air carriers and reservation companies will also not know which ad- 
ditional data attributes they may be required to collect from passengers, to support 
Secure Flight operations, as reservations are made. These decisions will also directly 
influence the number of analysts that TSA and TSC will need to manually review 
potential matches to the TSDB. Accordingly, stakeholders have expressed concern 
that they have not been provided information about what these decisions are. They 
stated that they are awaiting additional information from TSA in order to move for- 
ward with their plans to interface with and support Secure Flight. 

Efforts to Improve Data Quality and Accuracy Are Under Way, but Additional Work 
Remains 

Two additional factors that will impact the effectiveness of Secure Flight are (1) 
the accuracy and completeness of data contained in TSC’s TSDB and in passenger 
data submitted by air carriers, and (2) the ability of TSA and TSC to identify false 
positives and resolve possible mistakes during the data matching process, in order 
to minimize inconveniencing passengers. According to TSA and TSC officials, the 
data attributes that Secure Flight will require for name matching need to be in- 
cluded in both the passenger data and the TSDB in order for the automated system 
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to effectively match names between the two lists. As we reported in March 2005, 
while the completeness and accuracy of data contained in the TSDB can never be 
certain — given the varying quality of intelligence information gathered, and changes 
in this information over time — TSC has established some processes to help ensure 
the quality of these data. However, the DOJ-OIG, in its June 2005 review of TSC, 
found that the TSC could not ensure that the information contained in its databases 
was complete or accurate. According to a TSC official, since the time of the DOJ- 
OIG review, TSC has taken several steps to improve the quality of TSDB records, 
including conducting a record-by-record review, updating procedures for a daily re- 
view of each new or modified record, and using automated rules to check the com- 
pleteness of records received from other agencies. According to this official, TSA 
and TSC plan to enter into a letter of agreement that will describe the TSDB data 
elements that TSC will produce for TSA, among other things, to be used for Secure 
Flight. However, these data requirements have not yet been determined. 

In order to obtain accurate and complete passenger data from air carriers, TSA 
plans to describe the required data attributes that must be contained in passenger 
data provided to TSA in the forthcoming rule. TSA also plans to issue a final and 
complete DTPG to specify the data formats and other transmission requirements. 
However, the accuracy and completeness of the information contained in the pas- 
senger data record will still be dependent on the air carriers’ reservations systems 
and passengers, and the air carriers’ modifications of their systems for transmitting 
the data in the proper format. These steps are not trivial, as indicated by the June 
2004 historical passenger data provided by the air carriers for TSA’s name-matching 
tests. For these tests, many passenger data records submitted by air carriers were 
found to be inaccurate or incomplete, creating problems during the automated 
name-matching process. For example, some passenger data included invalid char- 
acters or prefixes, such as “Mr.” and “Mrs.,” in the name fields. Other inaccuracies 
included invalid characters or prefixes, spelling errors, and inverted birth date infor- 
mation. Additionally, some of the records had omitted or incomplete data elements 
necessary for performing the automated match or were in an unusable format. 

In a related effort to address accuracy, TSA and TSC plan to work together to 
identify false positives as passenger data are matched against data in the TSDB and 
to resolve mistakes to the extent possible before inconveniencing passengers. The 
agencies will use intelligence analysts during the actual matching of passenger data 
to data contained in the TSDB to increase the accuracy of data matches. As indi- 
cated in figure 1, when TSA’s name-matching technologies indicate a possible 
match, TSA analysts are to manually review all of the passenger data and other 
information to determine if the passenger can be ruled out as a match to the TSDB. 
If a TSA analyst cannot rule out a possible match, the record will be forwarded to 
a TSC analyst to conduct a further review using additional information. According 
to a TSC official, TSA and TSC analysts participated in a tabletop exercises to test 
the consistency of their respective manual reviews, and found that the matching 
logic used by both groups of analysts was consistent. This official stated that TSA 
and TSC also tested their operational procedures, and found gaps in their proce- 
dures that are now being addressed. According to this official, TSA and TSC plan 
to conduct additional joint exercises. Completing these exercises will be important 
to further understanding the effectiveness of using intelligence analysts to clear 
misidentified passengers during Secure Flight operations. 

False Identifying Information and Identity Theft Could Impact the Security Benefits 
of Secure Flight 

Another factor that could affect Secure Flight’s effectiveness in identifying known 
or suspected terrorists is the system’s inability to identify passengers who falsify 
their identif 3 dng information or who commit identity theft. TSA Officials stated 
that the program is not intended to or designed to protect against the use of falsified 
identities or to detect identity theft. However, TSA officials stated that the use of 
commercial data during the name-matching process may help identify situations in 
which a passenger submits fictitious information such as a false address. In the 
spring of 2005, a TSA contractor tested the use of commercial data composed of per- 
sonally identifiable information (such as name and address) to determine, among 
other things, if such data could be used to increase Secure Flight’s effectiveness in 
identifying false or stolen identities. However, according to the DHS Data Privacy 
and Integrity Advisory Committee report, testing performed to date does not provide 
a reasonable case for utilizing commercial data as part of Secure Flight. TSA offi- 
cials are not currently pursuing the use of commercial data to support Secure Flight 
because the Fiscal Year 2006 DHS Appropriations Act prohibits TSA from using 
data or databases obtained from or that remain under the control of a non-federal 
entity, effectively terminating this type of testing for the duration of Fiscal Year 
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2006. Further, TSA officials stated that incorporating biometrics — technologies 
that can automate the identification of people by one or more of their distinct phys- 
ical or behavioral characteristics — is not currently envisioned for Secure Flight. As 
noted in our previous work, biometric technologies, such as fingerprint recognition, 
are being used in other TSA screening programs. Moreover, the current 
prescreening process of matching passenger names against no-fly and selectee lists 
implemented by air carriers also does not protect against identity theft or the use 
of fictitious identities. 

Secure Flight Privacy Notices and Passenger Redress Process Cannot Be 
Finalized Until Program Requirements Are More Fully Defined 

TSA is aware of, and plans to address, the potential for Secure Flight to adversely 
affect travelers’ privacy and impact their rights. However, TSA, as part of its re- 
quirements development process, has not yet clearly identified the privacy impacts 
of the planned system or the full actions it plans to take to mitigate them. Nor has 
the agency completed its assessment of the potential impact on passenger privacy 
of the system in an operational environment or defined its redress process for Se- 
cure Flight because, in part, the operational plans and system requirements for Se- 
cure Flight have not been finalized. TSA officials stated that they are in the process 
of reviewing new privacy notices that will be issued in conjunction with a forth- 
coming rule making prior to proceeding with its initial operating capability, and 
that these notices will also address certain aspects of Secure Flight’s redress proc- 
ess. Until TSA finalizes system requirements and notices, however, privacy protec- 
tions and impacts cannot be assessed. 

Privacy Cannot Be Fully Assessed Because System Development Documentation Does 
Not Fully Address Privaey Requirements 

The Privacy Act and the Fair Information Practices — a set of internationally rec- 
ognized privacy principles that underlie the Privacy Act — limit the collection, use, 
and disclosure of personal information by Federal agencies. While TSA has reiter- 
ated its commitment to meet the requirements of the Privacy Act and the Fair Infor- 
mation Practices, it is not yet evident how this will be accomplished. To begin 
with, TSA has not decided what data attributes from the PNR it plans to collect, 
or how such data will be provided by airlines, through CBP, to TSA. Further, ac- 
cording to TSA officials, the agency is in the process of developing but has not 
issued the system of records notice, which is required by the Privacy Act, or the 
privacy impact assessment, which is required by the E-Government Act,^® that 
would describe how TSA considered privacy in the development of the system and 
how it will protect passenger data once the system becomes operational. 

Moreover, privacy requirements were not incorporated into the Secure Flight sys- 
tem development process in such a way that would explain whether personal infor- 
mation will be collected and maintained in the system in a manner that complies 
with statutory requirements and TSA’s SDLC guidance. One requirement of the pri- 
vacy impact assessment is that privacy be addressed in the systems development 
documentation. In addition, TSA’s SDLC guidance acknowledges that privacy pro- 
tections should be planned for and carried out as part of the system development 
process. In our review of Secure Flight’s system requirements, we found that privacy 
concerns were broadly addressed in Secure Flight’s functional requirements, but had 
not been translated into specific system requirements. For example, the functional 
requirements stated that the Privacy Act must be considered in the development of 
the system, but the system requirements documents do not reflect how privacy pro- 
tections will be supported by the system. Rather, system requirements documents 
state that privacy requirements are “yet to be finalized.” TSA’s Privacy Officer stat- 
ed that she has been collaborating with the system development team, but this is 
not evident in the documents we reviewed. 

Without taking steps to ensure that privacy protections are built into the system 
requirements, TSA cannot be assured that it will be in compliance with the Privacy 
Act once operational, and it runs the risk of repeating problems it experienced last 
spring. We reported in July 2005 that TSA’s initially issued privacy notices for the 
Secure Flight data-processing tests did not meet Privacy Act requirements because 
personal information was used in testing in ways that the agency had not disclosed 
to the public. We explained that in its fall 2004 notices, TSA had informed the 
public of its plans to use personal information during Secure Flight testing, includ- 
ing the use of commercial data in a limited manner. However, these initial notices 
did not fully describe how personal information would be collected, used, and stored 
for commercial data testing as it was carried out. As a result, individuals were not 
fully informed that their personal information was being collected and used, nor did 
they have the opportunity to comment on this or become informed on how they 
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might exercise their rights of access to their information. Although TSA did not fully 
disclose its use of personal information prior to beginning Secure Flight commercial 
data testing, the agency issued revised privacy notices in June 2005 to more fully 
disclose the nature of the commercial tests and address the issues disclosed by us. 

As we reported in March 2005, until TSA fully defines its operational plans for 
Secure Flight and addresses international privacy concerns, it will remain difficult 
to determine whether the planned system will offer reasonable privacy protections 
to passengers who are subject to prescreening or mitigate potential impacts on pas- 
sengers’ privacy. At that time, we recommended that TSA finalize privacy policies 
and issue associated documentation prior to Secure Flight achieving initial oper- 
ating capability. TSA acknowledged that it needs to publish new privacy notices to 
cover the collection, use, and storage of personal data for Secure Flight’s initial and 
full operating capability, before beginning operational testing. TSA officials stated 
that these privacy notices are currently being reviewed by TSA and DHS and will 
be released in conjunction with the forthcoming rulemaking. 

TSA Has Not Determined Secure Flight’s Redress Process 

Congress mandates that Secure Flight include a process whereby aviation pas- 
sengers determined to pose a threat to aviation security may appeal that determina- 
tion and correct erroneous information contained within the prescreening system, 
TSA currently has a process in place that allows passengers who experience delays, 
under the current process run by air carriers, to submit a passenger identity 
verification form to TSA and request that the agency place their names on a cleared 
list. If, upon review, TSA determines that the passenger’s identity is distinct from 
the person on a watch list, TSA will add the passenger’s name to its cleared list, 
and will forward the updated list to the air carriers. TSA will also notify the pas- 
senger of his or her cleared status and explain that in the future the passenger may 
still experience delays. Recently, TSA has automated the cleared list process, ena- 
bling the agency to further mitigate inconvenience to travelers on the cleared list. 

The Intelligence Reform and Terrorism Prevention Act, enacted in December 
2004, directs TSA to include certain elements in its Secure Flight redress policy. 
Specifically, it requires the establishment of a timely and fair process for individuals 
identified as a threat to appeal the determination to TSA and correct any erroneous 
information. It further requires that TSA establish a method for maintaining a 
record of air passengers who have been misidentified and have corrected erroneous 
information. To prevent repeated delays of misidentified passengers, this record 
must contain information determined by TSA to authenticate the identity of such 
a passenger. In January 2006, TSA officials stated that no final decisions have been 
made regarding how TSA will address the relevant requirements for redress found 
in the Intelligence Reform and Terrorism Prevention Act requirements. However, 
OTSR officials stated that a cleared list will be part of the process. The June 2005 
concept of operations describes a process where individuals that are frequently 
misidentified as being on the TSDB and TSA selectee list can request to be placed 
on a list of individuals who have been cleared. 

In our March 2005 report, we recommended that TSA finalize its Secure Flight 
redress policies and procedures prior to achieving its initial operating capability. In- 
formation concerning aspects of the redress process will be published before oper- 
ational tests or full implementation of the Secure Flight process, and will be con- 
tained within the privacy notices that TSA officials stated will be released in con- 
junction with the forthcoming rulemaking. Moving forward, TSA has assigned a 
manager to serve as liaison with DHS on privacy and redress issues. 

Concluding Observations 

TSA has continued its development and testing of Secure Flight, but has made 
limited progress in addressing longstanding issues related to system development 
and testing, program management, and privacy and redress protections. To make 
and demonstrate progress on any large-scale information technology program, such 
as Secure Flight, an agency must first adequately define what program capabilities, 
such as requirements related to performance, security, privacy, and data content 
and accuracy, are to be provided. These requirements can then in turn be used to 
produce reliable estimates of what these capabilities will cost, when they will be de- 
livered, and what mission value or benefits will accrue as a result. For Secure 
Flight, well-defined requirements would provide a guide for developing the system 
and a baseline to test the developed system to ensure that it delivers necessary ca- 
pabilities, and would help to ensure that key program areas — such as security, sys- 
tem connectivity, privacy and redress protections — are appropriately managed. 

When we reported on Secure Flight in March 2005, TSA had committed to take 
action on our recommendations to manage the risks associated with developing and 
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implementing Secure Flight, including finalizing the concept of operations, system 
requirements and test plans; completing formal agreements with CBP and air car- 
riers to obtain passenger data; developing life cycle cost estimates and a comprehen- 
sive set of critical performance measures; issuing new privacy notices; and putting 
a redress process in place. Over the past 11 months, TSA has made some progress 
on ah of these areas, including conducting further testing of factors that could influ- 
ence system effectiveness and corroborating with key stakeholders. However, TSA 
has not completed any of the actions it had scheduled to accomplish. In particular, 
TSA has not yet developed complete system requirements or conducted important 
system testing (including stress testing), fully established security measures, made 
key decisions that will determine system effectiveness, developed a program man- 
agement plan and a schedule for accomplishing program goals, or published updated 
privacy and redress notices. Taken as a whole, this lack of progress indicates that 
the program has not been effectively managed and is at risk of failure. 

While we recognize that TSA faces program uncertainties that can directly impact 
Secure Flight’s development and progress, uncertainty is a component of most pro- 
grams, and should not be used as a reason for not defining requirements and devel- 
oping plans and cost estimates, to manage risk. We believe that Secure Flight, like 
all programs, can utilize best practices to develop such plans to manage program 
uncertainties. 

To its credit, TSA has recently taken actions that recognize the need to instill 
more rigor and discipline into the development and management of Secure Flight, 
including hiring a program manager with information systems program manage- 
ment credentials. We also support TSA’s efforts to rebaseline the program, including 
defining system requirements and finalizing a program management plan, including 
the development of schedules and cost estimates, before proceeding with program 
development. In fact, proceeding with operational testing and completing other key 
program activities should not be pursued until TSA puts in place a more disciplined 
life cycle process and defines system requirements. In the absence of this and other 
program information, such as requirements, capabilities, and benefits, further in- 
vestment in this program would be difficult to justify. 

We are also encouraged that DHS’s IRB — the executive decision making authori- 
ties — has scheduled a review of Secure Flight and other people-screening programs. 
Given the potential duplication with GBP’s new initiatives for international 
prescreening, DHS, TSA, and CBP need to assess alternative system solutions that 
should be factored into Secure Flight’s rebaselined program and be the basis for IRB 
decisions regarding Secure Flight’s future. Notwithstanding these efforts, however, 
much work remains to be accomplished before Secure Flight is positioned to be prop- 
erly executed so that informed and prudent investment decisions can be made. 

Mr. Chairman, this concludes my prepared statement. I will be pleased to respond 
to any questions that you or other Members of the Committee have at the appro- 
priate time. 
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Appendix I 


Legislatively Mandated Secure Flight Issues to be Certified by the DHS and Reviewed 

by GAO 


Legislative mandated issue (number 
and short title) 

Description of mandated issue 

1. Redress process 

A system of due process exists whereby aviation passengers 
determined to pose a threat are either delayed or prohib- 
ited from boarding their scheduled flights by TSA may ap- 
peal such decisions and correct erroneous information con- 
tained in CAPPS II or Secure Flight or other follow-on/suc- 
cessor programs. 



32 


Legislatively Mandated Secure Flight Issues to be Certified by the DHS and Reviewed 

by GAO — Continued 


Legislative mandated issue (number 
and short title) 


Description of mandated issue 


2. Accuracy of databases and ef- 
fectiveness of Secure Flight 


3. Stress testing 


4. Internal oversight 


5. Operational safeguards 

6. Security measures 

7. Oversight of system use and 
operation 

8. Privacy concerns 

9. Modifications with respect to 
intrastate travel to accommo- 
date states with unique air 
transportation needs 


10. Life-cycle cost estimates and 
expenditure plans 


The underlying error rate of the government and private 
databases that will be used to both establish identity and 
assign a risk level to a passenger will not produce a large 
number of false positives that will result in a significant 
number of passengers being treated mistakenly or security 
resources being diverted. 

TSA has stress-tested and demonstrated the efficacy and ac- 
curacy of all search technologies in CAPPS II or Secure 
Flight or other follow-on/successor programs and has dem- 
onstrated that CAPPS II or Secure Flight or other follow- 
on/successor programs can make an accurate predictive as- 
sessment of those passengers who may constitute a threat 
to aviation. 

The Secretary of Homeland Security has established an in- 
ternal oversight board to monitor the manner in which 
CAPPS II or Secure Flight or other follow-on/successor 
programs are being developed and prepared. 

TSA has built in sufficient operational safeguards to reduce 
the opportunities for abuse. 

Substantial security measures are in place to protect CAPPS 
II or Secure Flight or other follow-on/successor programs 
from unauthorized access by hackers or other intruders. 

TSA has adopted policies establishing effective oversight of 
the use and operation of the system. 

There are no specific privacy concerns with the technological 
architecture of the system. 

TSA has, in accordance with the requirements of section 
44903 (j)(2)(B) of title 49, United States Code, modified 
CAPPS II or Secure Flight or other follow-on/successor 
programs with respect to intrastate transportation to ac- 
commodate states with unique air transportation needs 
and passengers who might otherwise regularly trigger pri- 
mary selectee status. 

Appropriate life-cycle cost estimates, and expenditure and 
program plans exist. 


Source: GAO. 


ENDNOTES 

^Section 518 of the Department of Homeland Security Appropriations Act, 2006 
(Pub. L. 109-90) requires GAO to report to the Committees on Appropriations of the 
Senate and House of Representatives on the 10 issues listed in § 522(a) the Depart- 
ment of Homeland Security Appropriations Act, 2005 (Pub. L. 108-334), not later 
than 90 days after the Secretary of the Department of Homeland Security certifies 
to the above-named committees that Secure Flight has satisfied the 10 issues. These 
10 issues relate to system development and implementation, effectiveness, program 
management and oversight, and privacy and redress. We are also conducting our on- 
going review in response to requests from the United States Senate: the Committee 
on Commerce, Science, and Transportation, and its Subcommittee on Aviation; Com- 
mittee on Appropriations, Subcommittee on Homeland Security; Committee on 
Homeland Security and (Governmental Affairs; Committee on Judiciary; also the 
House of Representatives: Committee on Transportation and Infrastructure, Com- 
mittee on Homeland Security; and the Chairman of the Committee on Government 
Reform. 

2 GAO, Aviation Security: Secure Flight Development and Testing Under Way, hut 
Risks Should Be Managed as System Is Further Developed, GAO-05-356 (Wash- 
ington, D.C.: March 2005). 

^This statement does not provide information on the area of congressional inter- 
est related to modifications with respect to intrastate travel to accommodate states 
with unique air transportation needs because data were not yet available to us on 
the effect of these modifications on air carriers. 
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“^TSC was established in accordance with Homeland Security Presidential Direc- 
tive-6 to consolidate the government’s approach to terrorism screening, including the 
use of terrorist information for screening purposes. TSC is an interagency effort in- 
volving DHS, Department of Justice, Department of State, and intelligence commu- 
nity representatives and is administered by the Federal Bureau of Investigation. 

® CAPPS rules are characteristics that are used to select passengers who require 
additional security scrutiny. CAPPS rules are Sensitive Security Information. 

® Aviation and Transportation Security Act, Pub. L. 107-71, §136, 115 Stat. 597, 
637 (2001). 

■^TSA plans to use this centralized vetting capability to identify terrorist threats 
in support of various DHS and TSA programs. In addition to Secure Flight, TSA 
plans to use the platform to ensure that persons working at sensitive locations; serv- 
ing in trusted positions with respect to the transportation infrastructure; or trav- 
eling as cockpit and cabin crew into, within, and out of the United States are prop- 
erly screened depending on their activity within the transportation system. In addi- 
tion to supporting the Secure Flight and Crew Vetting programs, TSA expects to 
leverage the platform with other applications such as TSA screeners and screener 
applicants, commercial truck drivers with hazardous materials endorsements, avia- 
tion workers with access to secure areas of the airports, alien flight school can- 
didates, and applicants for TSA’s domestic Registered Traveler program. 

® The Intelligence Reform and Terrorism Prevention Act of 2004 requires that TSA 
begin to assume responsibility for the passenger prescreening function within 180 
days after the completion of testing. Pub. L. 108-458 §4012, 118 Stat. 3638, 3714- 
19 (codified as amended at 49 U.S.C. § 44903(j)(2)). 

3 This description of the Secure Flight system, as well as the graphic illustrating 
the system in figurel, is based on TSA’s draft June 9, 2005, concept of operations, 
a document that gives a high-level overview of the Secure Flight system. 

i^TSA also plans to utilize a cleared list as part of the watch list matching proc- 
ess; the cleared list is composed of individuals who are frequently misidentified as 
being on the TSDB and who have applied, and been approved, to be on the list. 

These measures may include additional screening or other law enforcement ac- 
tions. 

12 Some selectees will receive a boarding pass from air carriers, but be required 
to undergo secondary screening prior to boarding the aircraft, while other selectees 
will hrst be met by law enforcement personnel, who will determine if the individual 
should receive a boarding pass. In addition, air carriers, through their application 
of the CAPPS rules, may also designate a passenger as a selectee. 

12 Examples of higher-order sources include legislation, which may dictate certain 
requirements, and other system documentation, such as the operational concept, 
when requirements are managed well, traceability can be established from the 
source requirements to lower-level requirements and from the lower level back to 
their source. Such bidirectional traceability helps determine that ah source require- 
ments have been addressed completely and that all lower-level requirements can be 
verihed as derived from a valid source. 

'^’‘Key requirements documentation we reviewed included the Transportation Vet- 
ting Platform/Secure Flight System Requirements Specihcation (May 13, 2005), the 
Secure Flight System Security Plan (July 15, 2005), the Transportation Vetting 
Platform System Security Plan (July 15, 2005), Transportation Vetting Platform and 
Secure Flight Security Risk Assessment (July 15, 2005), and documentation called 
for under Federal Information Processing Standard (FIPS) 199 (August 23, 2005). 

IS The NIST requirements provide guidelines for selecting and specifying security 
controls for information systems supporting the executive agencies of the Federal 
Governments. The guidelines apply to ah components of an information system that 
processes, stores, or transmits Federal information. 

isAn authorization to operate is issued for the information system, if, after as- 
sessing the results of the security certification, the authorizing official deems that 
the risk to agency operations, agency assets, or individuals is acceptable. 

i^OMB, Circular No. A-11, Part 7, Sec. 300. Planning, Budgeting, Acquisition, 
and Management of Capital Assets. 

The DHS Investment Review Board also reviewed the CAPPS II program in Oc- 
tober 2003 and authorized the program to proceed with the system’s development. 

i®The Committee was established under the authority of the Homeland Security 
Act, Pub. L. 107-296, in accordance with the provisions of the Federal Advisory 
Committee Act (5 U.S.C. App.2). At the first meeting of the Committee, in April 
2005, Secure Flight was recommended as a program for examination for numerous 
reasons, including the number of citizens affected by the program, weaknesses in 
the program’s redress system identified by us in our March 2005 report, and the 
program’s potential use as a model for other related DHS efforts. 
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The Aviation Security Advisory Committee, now within DHS, was formed in 
1989 to provide advice on a variety of aviation security issues. 

Department of Justice Office of the Inspector General, Review of the Terrorist 
Screening Center’s Efforts to Support the Secure Flight Program, August 2005. Con- 
gress requested that the DOJ-OIG evaluate TSC’s plans to support Secure Flight 
to report these findings to the House and Senate Appropriations Committees. 

Department of Justice Office of the Inspector General, Review of the Terrorist 
Screening Center, June 2005. 

22 The current draft of the DTPG also includes several appendices that provide ad- 
ditional, detailed program information to airlines, including an Interface Control 
Document containing detailed technical information such as message content and 
screen layout, a high-level technical plan for implementing various components of 
Secure Flight, detailed programming specifications for message timing and instruc- 
tions for various passenger vetting scenarios, a recommendation that the airline in- 
dustry develop an industry standard method for communicating Full Name (FN) 
and Date of Birth (DOB), and the system operational test plans. 

2^1 Stress testing refers to measuring a system’s performance and availability in 
times of particularly heavy (i.e., peak) load. 

25 According to the DOJ-OIG, when Secure Flight becomes operational, TSC an- 
ticipates a significantly greater operational workload as a result of the program and 
an increased need for staff, space, and funding. 

26 Correspondence to the Honorable Michael Chertoff, Secretary, Department of 
Homeland Security, October 27, 2005. 

27 GBP and TSA officials stated they will use this same network to transmit data 
for their respective international and domestic prescreening efforts. Different ad- 
dresses on the passenger information will ensure that TSA and CBP data are routed 
to the appropriate handling agencies for screening. 

28 For international prescreening, name-matching is conducted using data ele- 
ments from a passport, whereas passports are not required for domestic flights. 

29 We currently have an on-going review of GBP’s international prescreening proc- 
ess, including assessing the current process for conducting international passenger 
prescreening and reviewing the benefits and challenges of implementing additional 
or enhanced international prescreening strategies. 

86 Whereas stress testing is used to determine the maximum capacity of the sys- 
tem, operational testing is used to ensure that the system operates as intended, in- 
cluding the people and the information technology systems operating together in 
their expected environments. 

81 The name matching process depends on the level of false positive and false neg- 
ative matches deemed acceptable. False negatives are passengers incorrectly not 
matched to a watch list. 

82 The score is based, in part, on how much weight is given to, say, name or date 
of birth relative to each other. 

88 Department of Justice Office of the Inspector General, Review of the Terrorist 
Screening Center, June 2005. According to the DOJ Office of the Inspector General’s 
report, some errors in the TSDB might be corrected by a manual review conducted 
by intelligence analysts and a redress process. 

81 We have an ongoing review of the reasons misidentifications occur using TSDB 
data, and the efforts by the TSC and other agencies to reduce these errors. 

85 Department of Justice Office of the Inspector General, Review of the Terrorist 
Screening Center’s Efforts to Support the Secure Flight Program, August 2005. 

86 Falsifying identifying information involves passengers attempting to hide their 
true identities by submitting fictitious identifying information, such as false ad- 
dresses, when purchasing tickets. Identity theft would involve a passenger “steal- 
ing” another person’s identifying information, such as name and date of birth, and 
then using that identifying information to create fraudulent documents associated 
with the identity (such as a driver’s license containing the stolen identifiers with 
the thiefs picture). This is sometimes referred to as identity fraud. 

87 The Department of Homeland Security Appropriations Act, 2006, Pub. L. 109- 
90, §518 (e), 119 Stat. 2064, 2085 (2005). 

88 This prohibition on the use of appropriated funds does not apply to passenger 
name record data obtained from air carriers. 

89 GAO, Aviation Security: Challenges in Using Biometric Technologies, GAO-04- 
785T (Washington, D.C.: May 19, 2004). 

40 Privacy Act of 1974, Pub. L. 93-579, 88 Stat. 1896 (codified as amended at 5 
U.S.C. §552a). 

41 Also, in its mandate regarding Secure Flight, Congress asked that GAO review 
whether there are any specific privacy concerns with the technological architecture 
of the Secure Flight system. 
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The Privacy Act requires that an agency publish a system of records notice in 
the Federal Register upon establishment or revision of the existence and character 
of any system of records. See § 552a(e)(4). 

‘‘^The E-Government Act of 2002 requires agencies to conduct a privacy impact 
assessment before developing systems that collect, maintain, or disseminate infor- 
mation in an identifiable form. Pub. L. 107-347, 116 Stat. 2899. 

‘‘^'‘GAO, Aviation Security: Transportation Security Administration Did Not Fully 
Disclose Uses of Personal Information during Secure Flight Program Testing in Ini- 
tial Privacy Notices, hut Has Recently Taken Steps to More Fully Inform the Public, 
GAO-05-864R (Washington, D.C.: July 22, 2005). 

-‘sSee Pub. L. Nos. 108-334, § 522(a)(1); and 109-90, § 518(a). 

'^®TSA’s Office of Transportation Security Redress manages redress for the cur- 
rent watch list matching process conducted by the air carriers. Currently OTSR is 
developing an agency-wide policy for redress and has interviewed TSA Officials as 
part of this effort, but found that Secure Flight requirements were not sufficiently 
defined for use in drafting the new policy. TSA officials stated that they are con- 
tinuing to discuss the Secure Flight redress process with OSTR. 

47 See Pub. L. 108-458, § 4012(a) (codified at 49 U.S.C. § 44903(j)(2)(C), (G)). 

4® This requirement generally addresses principles from both the Privacy Act — 
that individuals be able to access and correct their personal information — and the 
Fair Information Practice of individual participation — that individuals be able to 
know about the collection of personal information, to access that information, to re- 
quest correction, and to challenge the denial of such requests. However, Secure 
Flight’s redress system will be challenging for two significant reasons. First, much 
of the information underlying decisions to add individuals to the TSDB is likely to 
be classified, and as such will not be accessible to passengers. Second, TSA does not 
control the content of the TSDB that it intends to use as the primary input in mak- 
ing screening decisions. 

The Chairman. Thank you very much. 

Mr. Hawley, since September 11th the Congress mandated mul- 
tiple layers of security benefits to secure commercial aviation, in- 
cluding explosive devices — the explosive-device systems for baggage 
and hand screening procedures for passengers, expansion of the 
prohibited-items list, and hardened cockpit doors. New tech- 
nologies, such as full-body imaging and explosive detectors for pas- 
sengers, are also being deployed at airports by your agency to be 
used as secondary screening tools. With all of that, what really is 
the necessity for the Secure Flight Program? 

Mr. Hawley. The Secure Flight Program is, I believe, an essen- 
tial layer to that, which is to take known terrorists, who could be 
threats to the aircraft, and not let them get near the aircraft. And 
it’s the requirement of the Intelligence Reform bill and the rec- 
ommendation of the 9/11 Commission. So, it is a system that is es- 
sential and has continued to improve. And I’d like to just stress 
that every known terrorist, known to the U.S. Government, is, 
today, denied boarding. In the real world of today, that is in place. 
And it will become better when Secure Flight is implemented, but 
we’re not waiting on Secure Flight for that. 

The Chairman. How much has your agency spent to launch this 
and finish the Secure Flight Program? And what about the prede- 
cessor program, CAPPS II? I think we’re interested in what we can 
do to assist, but it does seem that that program’s taken a lot of 
money, and there are others coming. 

Mr. Hawley. Yes, sir. $144 million, I believe, is the money for 
Secure Flight. CAPPS II was a program that started off as a pro- 
gram to evaluate the security risk of the passenger. It was discon- 
tinued toward the end of 2004, and Secure Flight went forward at 
that point, just for the terror watch-list matching. I think you put 
your finger on one of the key problems here is that the architecture 
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of CAPPS II, which was the original system, was used as the base 
for building Secure Flight on out, and the review that we’re doing 
now says, “Let’s just rebaseline it and say we’re going to do just 
the terror watch-list matching, and go from there.” 

The Chairman. I don’t want to embarrass anybody, and I don’t 
want to get in any trouble at home, but we have people like Ted 
Kennedy being stopped, my wife, Catherine Stevens, being ques- 
tioned whether she’s “Cat Stevens.” 

[Laughter.] 

The Chairman. How do people get off these lists? How do they 
prevent from being approached in a redundant way once that’s 
been established? 

Mr. Hawley. There is a process called the Redress Office, where 
we have a phone number and website, that the people who have 
familiar names — or names that are close to those of terrorists. They 
provide additional data. We give them a special number that then 
goes into their passenger record, and that list is actually kept, so 
that if they show up, they are removed from that confusion. And 
when it comes into Secure Flight, into the government, the system 
will run a little bit better, because it’ll be totally automated, where- 
as, now it’s part of the airline process. 

The Chairman. OK. 

I’m going to shift to you, Ms. Derrick. I think that the Congress 
mandated the GAO study ten elements of this program. Secure 
Flight, and it seems to me that TSA has an impossible task to 
move forward because of the criticism it’s received from your agen- 
cy on complying with those ten points. Aren’t you really holding up 
moving on to further actions by the detail of the criticism you’ve 
given for so long on Secure Flight? 

Ms. Derrick. Thank you, Mr. Chairman. 

We are mandated to look at those ten issues, and we have been 
working with TSA to be clear on the criteria that we’re using to 
assess the program. Dut I think the real reason for the program 
delays hasn’t been the review; it’s been, first of all, I think, a lack 
of key policy decisions made by DHS and TSA regarding some crit- 
ical aspects of the program that haven’t yet been decided. The big 
decision that hasn’t yet been made is what data TSA and DHS will 
require air carriers to provide. The air carriers are waiting for a 
rule to be issued. That rule has been pending for quite some time 
and hasn’t been issued. 

I think another reason for the delay is DHS’s oversight over Se- 
cure Flight. DHS has a mechanism in place called the Investment 
Review Doard, where they look periodically at major IT invest- 
ments at every major milestone, and at any time they feel the pro- 
gram needs to be reviewed, to make sure it’s progressing. DHS 
hasn’t reviewed Secure Flight in over a year through that Invest- 
ment Review Doard process. 

And in addition to the development process of Secure Flight, the 
requirements haven’t been fully defined. TSA isn’t following their 
own established development process of major IT systems. 

The Chairman. Well, how can they finish it if you constantly are 
asking them questions about what they haven’t done? I’d like you 
both to give us a timeframe. Mr. Hawley, how much time and how 
much money have you spent on Secure Flight? And you tell us how 
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much money — how much time you’ve spent. But I’m interested in 
how many people you’ve got holding up the total number of people 
he’s got. OK? Just for the record. * 

The Chairman. Senator Inouye? 

Senator Inouye. We’ve been concerned about privacy. I’m certain 
you realize that. Yesterday, we had a hearing on cell-phone pri- 
vacy. You’ve spent some time on security and privacy. How do you 
expect to approach this privacy problem? 

Mr. Hawley. Senator, I think the “privacy problem,” will not go 
away unless the system is designed from the bottom up, with every 
process done from the start with privacy in mind, that is the way 
that a system will be built that can go forward and give people in 
the public confidence that there’s not going to be a privacy problem. 
And that is what we’re doing in what I said today, recertifying the 
program will, in fact, do what I just suggested. And I believe that 
is the only way to do it. And, as we have known, we have tried very 
hard over 4 years to be perfect on privacy, and that is very hard, 
unless the system is built specifically with that in mind. 

Senator Inouye. Is it true that your agency is considering using 
private vendors to access information, personal information, in- 
stead of the Government? 

Mr. Hawley. For Secure Flight, no. For Registered Traveler, 
which would be a voluntary program, private-sector program, there 
is a possibility that they would use private-sector operations for 
that. 

Senator Inouye. The GAO has suggested that they have some 
difficulty determining how much has been spent. Do you have any 
idea? 

Mr. Hawley. Yes, I think that we’ve got a good handle on how 
much is being spent. So, 144 million, I think, is the number. The 
issue that I hear from the GAO is, “Your management controls, 
which go to being able to see whether you’re on target or off target, 
are not as specific as they need to be.” And I think that’s a fair 
criticism. 

Senator Inouye. Do you agree? 

Ms. Derrick. We’ve been unable to identify specifically how 
much has been spent on Secure Flight and its predecessor. We’re 
estimating about 132 million, which is pretty consistent. One of the 
problems we’ve identified, though, as they’re moving forward, the 
need for TSA to develop life-cycle cost estimates, and how much 
they think this program will cost in the out years. And that’s one 
of the areas that we think that TSA needs to focus on. 

Senator Inouye. Mr. Hawley, I’ve been told that you’re consid- 
ering using private screeners to run your Registered Traveler Pro- 
gram. Is that authorized under the law? 

Mr. Hawley. Yes. It is simply the same program that exists for 
every other aspect of TSA screening, that if the airport requests 
some combination of public and private, or all private, or all public, 
it’s my understanding that is allowed under the law. And so, our 
attitude is, we exist only in airports, as far as aviation is con- 
cerned, and we take very seriously the request of the local airport. 


* The information referred to is printed in the Appendix. 
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Senator Inouye. What about fraudulent or stolen identities? Are 
you being able to cope with that? 

Mr. Hawley. That is one of the major problems, I think, in secu- 
rity, is why you spend a lot of time understanding who the known 
terrorist is when that person doesn’t use their name. That is a 
challenge. And it is something that has to require the different lay- 
ers of detection, which include — that was where I mentioned 
CAPPS and the behavior aspect. And it’s something that we’re 
working very hard. And I think, as you know, we’ve done some pi- 
lots in the last couple of months that would add further layers di- 
rected at the unknown terrorist. 

Senator Inouye. Ms. Derrick, my final question, do you think 
that the Secure Flight concept is sound and worth the effort? 

Ms. Derrick. I think the program has the potential to provide 
some significant security benefits. The problem is, it hasn’t yet 
been proven whether or not it will do so. Some of these policy deci- 
sions I mentioned that haven’t yet been made have the ability to 
significantly influence how effective this program is, including how 
many additional people will be selected for screening. So, until 
these decisions are made and TSA follows this process that we’ve 
talked about to identify what capabilities they’re going to deliver, 
it’s difficult to determine what impact the system will have on 
aviation security. Dut I think the potential is there that it could 
strengthen aviation security. 

Senator Inouye. So, it’s worthwhile proceeding? 

Ms. Derrick. I think so. I think it’s important that TSA stop and 
rebaseline their program, as they’re doing, define their require- 
ments, and that DHS hold TSA accountable for making progress on 
meeting those requirements, within acceptable levels of cost. 

Senator Inouye. Thank you very much. 

Ms. Derrick. Thank you. 

Senator Inouye. Thank you, Mr. Chairman. 

The Chairman. Senator Nelson? 

Senator Den Nelson. Thank you, Mr. Chairman. 

Mr. Hawley, I’ve had constituents from Nebraska whose names 
were put on a terror watch list. We’ve eventually gotten them re- 
moved by going through the process that you’ve outlined. Can you, 
without revealing anything that shouldn’t be revealed, give us 
some idea about how that could happen? 

Mr. Hawley. Sure. 

Senator Den Nelson. It wasn’t like “Cat Stevens,” or it wasn’t 
something that was specific. These were fairly generic names. For 
the life of me, I could not understand how their names got on 
there. And we did have, initially, some significant difficulties in 
getting them removed — much, much more so than I would have ex- 
pected. 

Mr. Hawley. That part of the program, the so-called “redress,” 
has improved as we’ve gone along, and just like the rest of the pro- 
gram, needs further improvement. Dut the way it works 

Senator Den Nelson. Well, I can understand that. Dut how — I 
mean, I — I’m glad it’s being improved. Dut how could it have been 
so flawed at the beginning? That’s my question. 

Mr. Hawley. It’s that a terrorist is identified, and that indi- 
vidual has a name and other identifying characteristics. And, un- 
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fortunately, there are a lot of people who have similar names; and, 
in many cases, the same name; and, in some cases, the same “other 
identifying information.” So, what’s happened is, there is a terrorist 
that’s using your name, and, once we figure out that the Nebraska 
person — what their identity is, and then we get their identifying in- 
formation, we put that in the system, and then they are not con- 
fused as the terrorist, at that point. But it is possible that when 
somebody’s added to the terror watch list, that everybody that flies 
with that identical name is going to have the first-time problem. 

Senator Ben Nelson. OK. But it is being corrected. Do you have 
any indication, in terms of numbers, of how many people have had 
to go through that redress process? 

Mr. Hawley. I know we have it. I don’t have it, off the top of 
my head. But we can 

Senator Ben Nelson. Could you give me that? 

Mr. Hawley. Certainly. 

Senator Ben Nelson. Because it seems like it might be dis- 
proportionate. I didn’t know there were a lot of people with the last 
name “Moore” that would have necessarily been on that list, so 
maybe you need to know more about that. 

And then I did mention the two-tiered system, which I can un- 
derstand for air fares, but I don’t understand for security purposes. 

Mr. Hawley. Yes, sir. The rules are, you enter TSA’s checkpoint 
at the point that you present yourself to the screener, essentially, 
and that the airline has the responsibility of line management. So, 
it is at the discretion of 

Senator Ben Nelson. The airline or the airport? 

Mr. Hawley. The airline, I believe. 

Senator Ben Nelson. What if there are multiple airlines 
using 

Mr. Hawley. Yes. Well 

Senator Ben Nelson. — the same security? 

Mr. Hawley. There is an agreement that’s worked out, of actu- 
ally fairly longstanding practice, of how to work that out. 

Senator Ben Nelson. Well, I 

Mr. Hawley. In other words, it’s not a TSA decision that says 
there should be X number of lines. 

Senator Ben Nelson. OK. You think that’s OK? We pay — we all 
pay the two-fifty for each segment of the flight, but we get different 
treatment at the airport prior to security. 

Mr. Hawley. Well, when you show up to a TSA employee, we 
treat people the same, unless there is a security reason not to. 

Senator Ben Nelson. All right. 

With respect to the Registered Traveler program, you said that 
it’s going to be paid for by the people who voluntarily submit them- 
selves to that program. What about recovering developmental 
costs? 

Mr. Hawley. Our plan is to cover the costs of the total program 
by those who use it. And I have just been provided the answer to 
your question about how many, and the answer is 30,000 total, or 
about 1500 a week. 

Senator Ben Nelson. That end up on that 

Mr. Hawley. Redress list. 

Senator Ben Nelson. — redress list. 
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What about — do we know what the costs have been for develop- 
ment of the Registered Traveler program? And do we have an indi- 
cation of how many people are going to use it, so that we get a 
quantifier of what it’s going to cost per person, so that there is a 
recovery of the costs? 

Mr. Hawley. It’s a market-based program, and we’ve worked 
very hard to get the lines for everybody down to a very manageable 
length of time. And that effort continues to be successful, which 
may lessen the market for a Registered Traveler Program. That’s 
why we left it to the private sector, that says if there is, in fact, 
a market, they will make themselves known, they’ll figure it out. 
But, from the TSA point of view, we did not feel it was essential 
for us to invest taxpayer money to go figure out the answer to that 
question. 

Senator Ben Nelson. Well, I would agree, if — except for the fact 
that there’s also a risk analysis going along with it, and if you have 
the Registered Traveler program in place, you would theoretically, 
and hope in actual practice, be the case that you would have less 
risk associated with those registered travelers; therefore, you could 
spend less time on them, more time where the risk could be great- 
er, because the unknown and the uncertainty factors are there. So, 
they’re really — I mean, I don’t mind going to the outside to pay for 
it, but I think there is a cost savings associated with your agency 
not having to have personnel spend time on registered travelers, 
not because they’ve got priority treatment, but because they rep- 
resent less of a risk. 

Mr. Hawley. Yes, sir, we agree with that logic. 

Senator Ben Nelson. So, I guess I’m not objecting to your going 
to the outside; I don’t see the logic for going to the outside. 

Mr. Hawley. It’s that we have other priorities that are more im- 
portant; and sometimes in making priorities the Secure Flight is a 
bigger priority for us than Registered Traveler. And these other 
layers of security, we feel, are critical. And it’s a question of band- 
width, it’s a question of money. 

Senator Ben Nelson. In terms of any kind of a cost-benefit anal- 
ysis for Secure Flight or Registered Traveler, do you feel that 
you’ve been able to — you said that trying to get the costs are hard 
to determine, but have you developed a cost-benefit analysis that 
might help us shed some — might shed some light on whether we’re 
improving security or we’re just keeping people busier going 
through the airports? 

Ms. Berrick. Yes, Senator. One of the things we looked at for 
Secure Flight — and we didn’t look at Registered Traveler — ^but with 
Secure Flight, we looked at: To what extent did TSA develop, first 
of all, a cost-benefit analysis and then define requirements and 
then pursue development of this program? We found that TSA 
didn’t develop a cost-benefit analysis for Secure Flight, specifically, 
so that there was nothing for us to review. 

I wanted to make one comment about GAO’s review of Secure 
Flight. The legislation requires that after TSA certifies that they 
have met these ten issues, then GAO has to assess their certifi- 
cation. So, the really — the next point in this process is TSA certi- 
fying that they’ve satisfied all these issues related to privacy and 
development. And it’s not pending a GAO review; they can move 
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forward and do that at any time. But we’ll continue to look at their 
development and privacy as they move forward with the program. 

Senator Ben Nelson. Thank you. 

And thank you, Mr. Chairman. 

The Chairman. Yes, sir. 

Senator Burns? 

STATEMENT OF HON. CONRAD BURNS, 

U.S. SENATOR FROM MONTANA 

Senator Burns. I keep looking at TSA, screening and airport se- 
curity. I wish we’d have stayed with my amendment on the floor 
and put airport security in the Department of Justice and let the 
marshals do it. Then we wouldn’t be meeting here today. We’d 
probably have these programs already in place. But we lost that 
fight, and now we’ve got to deal with this. 

I had the same problem with a couple of my constituents in Mon- 
tana that Senator Nelson had. And it took us a year and a half on 
one, and I’ve still got one in there. And the only place that this guy 
is dangerous is on a golf course. 

[Laughter.] 

Senator Burns. And I just fail to see, whenever you’ve got affida- 
vits and everything else identifying this guy, why — and if he’s trav- 
eling with someone, Mr. Hawley — they take his wife or the couple 
they may be traveling with and question them? They make a lot 
of trips back and forth between Montana and Arizona, and every 
time, they go to the room, and everybody that’s traveling with him 
goes too. So, I just wish that somebody down there would respond 
to those things. I understand the need for security. We’re not com- 
plaining about that. And so does he. But he has to put another 30 
minutes on his airport time, knowing that he’s going to go to the 
little room. And that’s very unhandy. 

Let me just ask a couple of questions on this particular program. 
Say that I have a card for this program. I’ve paid for it, I’ve com- 
plied with all the information. Does your department keep a data- 
base to keep track of my travel, or is that information cleared from 
the record at a certain point? I mean, how long do you keep the 
records of my travel and travel movements, or do you keep a data- 
base on it? 

Mr. Hawley. Well, we don’t get it for Secure Flight. It’s a bounc- 
ing mechanism that says. Is this person on the watch list, or not — 
yes or no? And that’s the end of it. 

Senator Burns. That doesn’t record the amount of times that I 
have walked through security to board an airplane? 

Mr. Hawley. No. 

Senator Burns. It’s not. 

Mr. Hawley. Not to my knowledge. Yes, 72 hours after the trip, 
we delete the record. 

Senator Burns. You clean the 

Mr. Hawley. Delete it. 

Senator Burns. You clean the records. 

Mr. Hawley. Yes. 

Senator Burns. Now, if a person is rejected, what is the process 
or the protocol for explaining why they were rejected? Is there a 
protocol? Do you give them the reasons why they were rejected? 
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Mr. Hawley. In most cases, no. Now, if the person is a mistake, 
then clearly yes. That’s a mistake, you shouldn’t be on the list, 
there’s a number you call, there’s a way you get yourself off the 
list. But if someone is on the list and is a terrorist, we do not feel 
the obligation to share with them everything that the Government 
knows. 

Senator Burns. OK. Now, I walked through a new machine at 
National the other day. They call it “the puffer,” or something. 

Mr. Hawley. Yes, sir. 

Senator Burns. Tell me the difference between that particular 
piece of equipment and the ones we’ve been using in the last year 
or so. 

Mr. Hawley. The puffer technology dislodges explosive particles 
that permeate you or your clothing or your belongings. And so, the 
puff of air dislodges some of that chemistry, it’s brought up into the 
top of the machine, where it goes through an analysis that is essen- 
tially the same one that happens when they do the swab of your 
material. It’s the same technology, to compare that with the known 
explosive. So, that’s what the technology is. It’s a different way. In- 
stead of rubbing the surface, it dislodges some of the small par- 
ticles. 

Senator Burns. I just thought of something. Are they going to 
ask you to survey on what kind of aftershave we’re using, or any- 
thing like that? 

Mr. Hawley. As long as it’s not explosive, you’ll be fine. 

Senator Burns. OK, just explosives. That’s a good thing. 

[Laughter.] 

Senator Burns. That’s a good thing. 

And that’s all I have, Mr. Chairman. I just wanted to ask about 
those particular items of concern for some of my constituents that 
travel quite a lot. And I find more people are willing to join the 
Registered Traveler program, just because they like to go get on 
the airplane. And so, that’s it. But thank you very much. 

Ms. Berrick. Senator, if I could add, quickly, the redress process 
that Mr. Hawley just explained was for the current prescreening 
process that the air carriers maintain. The redress process for Se- 
cure Flight hasn’t yet been fully defined, and that could also im- 
pact how long data is kept after the process, so that TSA could go 
back and make any corrections. 

Senator Burns. Yes, we have a tendency to run both of the pro- 
grams together, and I’m sorry about that. I didn’t make that clear. 

Thank you very much, Mr. Chairman. 

The Chairman. Thank you very much. 

Mr. Hawley, I wanted to arrange a classified briefing with you — 
I want to arrange a classified briefing with you on how this inter- 
sects with our information systems that will lead to intelligence- 
sharing. So, if we keep that in mind 

Mr. Hawley. Yes, sir. 

The Chairman. I don’t know what your timeframe is, but I do 
want the Committee to have a further briefing on the interlocking 
between this system and the intelligence systems that are further 
designed to assure the traveling public has the security it needs. 

We thank you both for being with us today. Thank you very 
much. 
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Ms. Berrick. Thank you, Mr. Chairman. 

The Chairman. Did you have any further questions, Senator? 

Our next panel is Jim May, the Chief Executive Officer of the Air 
Transportation Association; Charles Barclay, President of the 
American Association of Airport Executives; Tim Sparapani, Legis- 
lative Counsel for Privacy Rights at American Civil Liberties 
Union; and Bill Connors, the Executive Director, Chief Executive 
Officer of the National Business Travel Association. 

Ms. Snowe is here, and I failed to recognize her to put her state- 
ment in the record if she wishes. I know she had another commit- 
ment at Finance. 

We’re pleased to have you with us this morning, gentlemen. As 
I indicated before, your statements automatically go in the record 
as though read, and we’ll be pleased with your summaries. 

Mr. May, we’ll call on you first. 

STATEMENT OF JAMES C. MAY, PRESIDENT AND CEO, AIR 
TRANSPORT ASSOCIATION OF AMERICA, INC. 

Mr. May. Thank you, Mr. Chairman. In the interest of time. I’d 
like to summarize even my oral statement and make a couple of 
fundamental observations. 

First, I’d like to thank the Committee for again taking a prin- 
cipled stand that aviation security is a function of national secu- 
rity, and should be paid for as such. Regrettably, not everyone 
agrees with that. And as a result, we have more proposals from the 
Administration, trying to increase the security fees that we pay 
today. 

I think it’s important to put that in context as we begin this de- 
bate on Registered Traveler and Secure Flight, because when TSA 
was started up, it had a budget of roughly $4 billion; today it has 
roughly the same budget. We started paying fees, back in 2002 to 
TSA, that aggregated somewhere a little over $1.2 billion, just 
strictly to TSA. We have three other fees that we pay to other ele- 
ments of the Department of Homeland Security. I think we’re the 
only transportation mode that pays those. And those fees have now 
grown, in aggregate to DHS, to about $4 billion a year from that 
initial beginning of $1.25 billion or $2.6 billion. And we now have 
proposals for an additional billion-four on top of what we’re already 
paying. 

So, we not only care about the business of security from the per- 
spective of trying to have our passengers, your constituents, move 
through airports as quickly and efficiently as possible, but we care 
from the perspective of the amount of money that we’re being 
charged, and our passengers are being charged, every single year 
by the Department of Homeland Security and TSA. And I hope 
that provides some perspective. 

Now, when it comes to the Registered Traveler program, you 
know, there’s an old line in song about “being country before coun- 
try was cool.” ATA was one of the original supporters of a reg- 
istered-traveler program, but let me ask you to think back to that 
time. That time was when we had not only people going through 
security, but, once you got to the gate, you had to go through the 
gauntlet one more time. And the likelihood is, if you were the third 
person to go through, everybody knew you were going to get pulled 
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aside, and you’d get searched and wanded, and you’d have to dump 
all your materials out onto a folding table and so forth. And so, we, 
at that point, said, look, let’s try and expedite this process a little 
bit, and maybe we can have a registered-traveler program. 

I hate to think about how much money has been wasted on the 
RT and the Secure Flight programs since that time, but the good 
news is that the process has improved dramatically. We got rid of 
the gate check, we’re doing other measured improvements to secu- 
rity. People are acustomed to going through the process. And in- 
stead of having those 2-hour waits, we now have, believe it or not, 
about a 10-minute wait, on average, throughout the system. So, the 
need for that Registered Traveler program that we first envisioned, 
I don’t think is there. 

What we really need to do today is get the TSA to focus on im- 
proving the process for all passengers, not a select few passengers. 
We need to get the better technology, the puffer technology that 
Senator Burns, I think, talked about. We need to make sure that 
we move through crews and pilots in a quicker way, because they 
are already certified to go through the process. We need to have 
more technology, as I said, and we need to get the TSA to start 
putting their part-time workers on during peak periods. I think if 
those changes are made, we’re going to see the process for every- 
body improve dramatically. 

Now, as to the RT program itself — or. I’m sorry, the Secure 
Flight program itself. I’d like to point out to the Committee that 
it’s not just the Secure Flight program. We, as airlines, have had 
to deal with CAPPS, with C^APPS II, with Secure Flight, with Reg- 
istered Traveler, with APIS, with APIS Plus 60, APIS AQQ, the 
CBP’s PNR access program, and, most recently, we’re being asked 
to comply with a bunch of requirements on data collection by CDC 
as it relates to avian flu. So, we are facing seven different govern- 
ment programs, all of which are intended and directed at passenger 
prescreening. There are some 34 different data elements that we’re 
being asked for. And there are at least 20 countries around the 
world that have similar kinds of programs. In my written testi- 
mony, I’ve suggested a series of things that can be done to simplify 
that process, but we are being inundated with data requests. 

So, our real request to this Committee is, please force TSA, force 
DHS, force CBP, force all of these different agencies to come up 
with a single simple template that can be used against the watch 
list, that can be used against other programs, and go forward with 
that, put your energies there, along with technology increases, so 
that we move everybody through the process more quickly than we 
are today, not just a special few who are willing to pay a great deal 
of money to become registered travelers for what I, personally, be- 
lieve are going to be very limited benefits. 

Thanks for your time. I’m happy to answer any questions. 

[The prepared statement of Mr. May follows:] 

Prepared Statement of James C. May, President and CEO, Air Transport 
Association of America, Inc. 

No consumer service industry is affected by security requirements like the U.S. 
airline industry. That central fact significantly shapes the economics of providing air 
transportation. Yet the airline does not control this situation because civil aviation 
security in the United States is a Federal responsibility. This is as it should be but 
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does not diminish the airline industry’s very legitimate interest in seeing that secu- 
rity-related measures are effectively conceived and properly and economically imple- 
mented. 

In the last several years, the Transportation Security Administration has clearly 
improved its screening of passengers and their baggage. Anyone who regularly trav- 
els by air has witnessed that improvement. And TSA has emphasized its commit- 
ment to using risk analysis to establish security priorities. These developments are 
encouraging and should be recognized. 

Nevertheless, important elements of the government’s aviation security programs 
are not nearly as cohesive or well founded as they could be. There is no justification 
for this. Aviation security is obviously dynamic but in these matters, to mix a meta- 
phor, we should have gotten our sea legs by now. We need to do so quickly. 

Today’s hearing is thus exceptionally important and timely. It is an opportunity 
for us to focus attention not only on the Secure Flight Program and the Registered 
Traveler Program but, equally important, also on other existing and emerging avia- 
tion security programs that will impose substantial new information demands on 
passengers and airlines. The characteristic that is common to these programs is 
their dependence on passenger information. That is where the commonality ends. 
These programs are uncoordinated, which is inexplicable and should attract close 
attention. Intuitively, most of us would assume that considerations of efficiency 
would have produced far more commonality among Federal programs that are both 
security oriented and data dependent. The fact that this has not happened should 
prompt an examination of their efficacy — how well they achieve their stated aviation 
security objectives; their efficiency — how economically they accomplish those objec- 
tives and whether less costly alternatives exist; and their protection of privacy — how 
thoroughly they preserve passengers’ expectations of privacy, and how adequately 
and transparently they delimit governmental agencies’ use of personal information. 

TSA’s Secure Flight Program and its Registered Traveler Program illustrate the 
complexities of data-based security programs and, in the case of Registered Trav- 
eler, the need to return to first principles when evaluating them. 

Secure Flight is intended to pre-screen airline passengers. As envisioned, an air- 
line would submit to TSA certain passenger information whenever a reservation is 
made for a domestic flight. It would enable TSA to compare reservation information 
with the Federal Government’s no-fly and selectee lists. TSA expects that this ar- 
rangement will enhance security, improve pre-screening efficiency and reduce the 
number of passengers subjected to secondary screening. Each of these outcomes 
would be very desirable. 

Airlines and ATA have worked with TSA at several points in its development of 
Secure Flight. We have also worked with CBP and CDC on their passenger informa- 
tion needs. This experience has left two important impressions. First, coordination 
between government agencies and airlines is essential. Any program that involves 
government access to reservation information generates substantial data content, 
format and transmission issues. You cannot simply push a button to get passenger 
data that would be useful to TSA or any other Federal agency. Second, privacy 
issues are of the utmost significance in any government program to access pas- 
senger data. Privacy issues are an immutable part of the landscape. 

The nature of Secure Flight is such that the airline industry’s involvement with 
TSA about it, necessarily, has been limited. Nevertheless, we are hopeful that its 
benefits can be soon realized. 

In contrast to our hopes about the Secure Flight Program, the Registered Traveler 
Program has turned into a shifting and dispiriting exercise. It compels you to ask, 
“Where’s the beef?” 

The airlines were early and ardent advocates of the registered traveler concept. 
Four years ago we urged the development of a government system that would speed 
the screening of those passengers who did not present security concerns and thereby 
facilitate the processing of the vast majority of travelers. Today’s Registered Trav- 
eler Program promises no such benefits to our customers. Indeed, the Registered 
Traveler Program as currently constituted has become even less attractive because 
it has been morphed into an orphan program; TSA has largely lateraled it to the 
private sector. Finally, the systemwide improvement in passenger screening that 
TSA has accomplished in the last few years begs the question of why this sorry 
state of affairs should continue. 

We are unaware of any evidence that Registered Traveler will produce the tan- 
gible and widely available benefits to passengers that we had envisioned in 2002; 
or that it will attract significant numbers of registrants; or that it will generate a 
pronounced improvement in overall security; or that vendor interoperability issues 
will be overcome; or that systemwide passenger wait times will diminish; or that 
passenger privacy issues have been confronted and satisfactorily resolved. We, how- 
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ever, do know that what was originally conceived as a straightforward governmental 
program to benefit the vast majority of passengers has been transformed into a com- 
mercial enterprise for what increasingly looks like the few. 

Registered Traveler neither offers the benefits to passengers nor the breadth of 
use that justify its introduction as a permanent program. It should be eliminated. 

As I observed at the beginning of my testimony, other existing and contemplated 
aviation security programs rely or will rely on government access to passenger infor- 
mation. Expanding passenger information requirements create substantial new de- 
mands on governmental agencies, airlines, and travelers. The problem is that gov- 
ernment passenger information requirements thus far have only produced a mosaic. 
It remains to be seen if a coherent a picture will emerge. 

This is a serious situation. Given the security threats confronting civil aviation, 
there is no reason to believe that the government’s passenger information needs will 
abate. Passenger data will be required for the Secure Flight program and the Reg- 
istered Traveler program. In addition, passenger information is currently required 
for CBP’s Advance Passenger Information System and GBP’s passenger reservation 
information access program. Moreover, foreign governments are imposing similar 
demands on airlines flying to their countries, including U.S. air carriers. This un- 
mistakable international trend is most evident with the ever-increasing number of 
countries that require APIS information but also is reflected in the Canadian re- 
quirement for access to passenger reservation information for international flights 
bound for Canada, including flights from the United States. Finally, the Centers for 
Disease Control has proposed a rule that would require that airlines collect and 
store broad new categories of passenger contact information. 

Information management is precisely where the government should be able to 
achieve a coherent policy. We appreciate the ongoing efforts of CBP and TSA to 
more closely align APIS and Secure Flight data requirements. However, the contin- 
ued absence of a comprehensive, government-wide passenger information access pol- 
icy is a matter of real concern to us. Nor is there any indication that any element 
of the Federal Government is inclined to assume the responsibility to develop and 
oversee such a comprehensive policy. 

This needs to change quickly. The U.S. Government must produce a uniform pas- 
senger information collection policy that applies to all of its civil aviation security 
and facilitation programs. Our government should also lead an effort to create such 
a policy for worldwide application. 

A workable government-wide passenger information policy should be predicated 
on four fundamental considerations. 

The first consideration is the recognition that a uniform policy is indispensable 
to the efficient collection, retention and use of passenger information. Multiple, un- 
coordinated information demands do not advance aviation security. Instead, they 
create unneeded complexity, wasteful duplication, and unjustifiable costs to the gov- 
ernment, customers and airlines. 

The second consideration is that a uniform policy must be based on a single pas- 
senger information template that contains the only authorized categories of data 
that a Federal agency can require collection of or access to. Agencies should be pro- 
hibited from imposing unilateral data requirements that go beyond the template. A 
uniform policy means no ad hoc data requirements. 

Similarly, uncoordinated methods of data transmission are unnecessarily complex 
and costly. This is not the forum to explore how best to resolve this issue. But I 
want to highlight the importance of working as best we can to develop a single 
“pipeline” to transmit passenger data to Federal agencies. Independent transmission 
channels to multiple Federal agencies mean duplicative work for both airlines and 
the government, and the unnecessary cost and drain on scarce resources that inevi- 
tably result from such inefficiency. 

The third consideration is that the justification for every passenger information 
collection program should be evaluated under uniform criteria. The needs of indi- 
vidual agencies may vary but the conditions under which any agency is permitted 
to collect or access passenger information should not vary. Six basic criteria should 
be relied upon: 

• Demonstrate civil aviation security or facilitation need. A clear, direct re- 
lationship between the security threat or facilitation need and the information 
sought should be demonstrated. Presumably, this will be tied to the agency’s 
risk assessment. Data needs not associated with security or facilitation should 
not be part of any passenger information program. 

• Minimize data demand. Data required should be the minimum necessary to 
fulfill an agency’s needs. This will reduce impositions on passenger privacy and 
diminish airline compliance costs. 
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• Use existing information sources. To the extent feasible, agencies should 
rely on existing government passenger information programs to fulfill their data 
needs. 

• Avoid adverse effects on passenger processing. Information collection re- 
quirements must avoid adversely affecting passenger processing, whether dur- 
ing the reservations process, airport check-in, security screening, or arrival in 
the United States from overseas. 

• Conduct thorough cost evaluation. Passenger information collection, storage 
and transmission costs, as well as individual passenger compliance costs must 
be recognized and carefully evaluated. A cost-benefit analysis based on these 
factors should be undertaken for each information collection or access program. 

• Minimize false hits. If passenger information is used to evaluate a passenger 
for security purposes, the program must contain measures that minimize false 
hits and enable the agency to evaluate its false hit experience. 

The fourth consideration is that the privacy implications of any proposed pas- 
senger information requirement must be rigorously examined before the implemen- 
tation of such a program. This is a matter of both accountability and legitimacy. It 
is a matter of accountability because the government should not demand personal 
information without performing such a careful analysis. It is a matter of legitimacy 
because the traveling program will not long support a government-imposed informa- 
tion program that it believes does not scrupulously protect an individual’s privacy. 

At the very least, this means that government programs must adhere to privacy 
principles that focus on information collection purpose, content, retention and on- 
ward transmission limitations. In addition, a prompt and effective redress mecha- 
nism must be available to those customers who believe that they have been ad- 
versely treated. 

Foreign governments’ data privacy principles must also be taken into account be- 
cause U.S. airlines that operate overseas are subject to them. Compliance in other 
nations is often enforced through both civil and criminal penalties. No U.S. airline 
should be subject to the conflicting requirements of the U.S. Government and a for- 
eign government. This concern is very concrete. U.S. airlines operating to Europe 
confronted that prospect several years ago when European governments expressed 
skepticism about the adequacy of CBP’s protection and use of passenger reservation 
information that it accesses. That situation has been resolved for the time being. 
It, however, left us with the clear realization that the U.S. Government — and not 
the U.S. airline industry — has the responsibility for resolving conflicts between its 
information requirements and the data privacy regulations of other nations. 

My experience over the last several years with security issues has convinced me 
of several things. First, coordination between the government and industry at the 
outset of the development of any aviation security program is critical and is plainly 
in the interest of the government, customers, and airlines. Second, we know how 
to measure the effectiveness of these programs; we should not be afraid to apply 
to them appropriate metrics — including risk and cost-benefit analyses. Third, we 
need to formulate, in very short order, a coherent government-wide policy about pas- 
senger information collection requirements. Fourth, resolution of privacy issues is 
crucial to the success of these programs and that resolution is the government’s re- 
sponsibility. 

Aviation security needs will change over time but the considerations that I have 
described in my testimony should facilitate prompt and effective responses to them, 
no matter how they may evolve. 

The Chairman. Thank you very much. 

The President of the American Association of Airport Executives, 
Chip Barclay. 

Chip? 

STATEMENT OF CHARLES BARCLAY, PRESIDENT, AMERICAN 
ASSOCIATION OF AIRPORT EXECUTIVES 

Mr. Barclay. Thank you, Mr. Chairman, Mr. Co-Chairman, 
Members of the Committee. It’s always a privilege to appear before 
the Commerce Committee. 

I’d like to make three points in summarizing our testimony. 
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The first is that airports continue to believe that the key lesson 
of 9/11 is that dangerous people pose the greatest threat to our sys- 
tem. On 9/11, the powerful weapon used against us was the terror- 
ists’ knowledge and manipulation of our hijacking policies of that 
day. And, while those policies have changed, what hasn’t is that de- 
liberate, smart terrorists will seek to exploit any system that we 
have or put in place in the future. So, in addition to other security 
efforts, we need to develop better tools that look for dangerous peo- 
ple. 

That job has two components. One is identifying the people that 
don’t pose a threat to the system, which is the great majority. And 
the second is identifying those few that present either unknown or 
potentially dangerous factors. Secure Flight appropriately seeks to 
go after that second goal, while Registered Traveler, or RT, offers 
a voluntary effective path to go after the first. 

Registered Traveler provides an option for individuals to volun- 
teer information on themselves, permit TSA to determine they 
don’t present a risk to the system, verify their identity each time 
they travel, and those individuals will pay for all the costs of that 
program. 

The privacy issues about both these programs raised by TSA and 
others during the hearing need careful attention and transparency 
in their resolution. But it is equally important to recognize that the 
constitutional protection to the right of privacy is not a right to an- 
onymity. Accurate, verifiable identification is a reasonable request 
of each airline passenger as a tool for maintaining a safe public- 
transportation system for all airline passengers. 

My second point is to let the Committee know that a significant 
group of airports and technology companies, some 70 airports and 
40 companies, have collaborated, through an organization called 
the Registered Traveler Interoperability Consortium, to come up 
with a secure, nationwide, and interoperable Registered Traveler 
program. The recommendations leave key security standards and 
the approval of individuals as qualified for Registered Traveler to 
TSA, but accomplishes much of the remaining work through local 
airports in whose terminals the programs must operate, and TSA- 
certified technology companies that can enable the highly accurate 
and consistent operating process required. 

My third point is that industry, local government, and Federal 
Government can work effectively as partners in security 
credentialing programs. One program the Committee has heard lit- 
tle about, because it’s effective, efficient, and has operated without 
controversy, is the aviation-worker Criminal History Record Check 
for employees with access to secure areas at commercial airports. 
Prior to 9/11, fewer than 10 percent of aviation workers were re- 
quired to obtain the CHRC checks through a Federally operated 
process. Those checks averaged, at that time, almost 2 months to 
complete, even though the FBI computer check of fingerprints usu- 
ally takes only minutes. The system was fraught with black holes, 
poor communication, and no reconciliation of the process for end 
users. 

Post- 9/11 reviews brought a new requirement to have these 
criminal history record checks for all workers with access to secure 
areas at airports, which was about a million in the year 2002, as 
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well as a new organization, the Transportation Security Clearing- 
house, that’s operated by AAAE. The background checks that it 
does there, it does in partnership with airports, airlines, and TSA. 
(Initially, that was with FAA). 

Four years later, the average criminal history record check takes 
4 hours, instead of 52 days. The price per transaction has been re- 
duced from $31 to $29, while an identical check for HAZMAT 
truckers costs $100. And the TSA has processed just shy of 2 mil- 
lion background checks, making it the largest such clearinghouse 
outside the Department of Defense in the last 4 years. 

The most important of those facts is the time savings, from 
months to hours, of these checks. It represents personnel cost sav- 
ings in our industry of hundreds of millions of dollars annually. 
This successful credentialing program works in a 24/7 realtime in- 
dustry. Because it’s an effective partnership of DHS, TSA, airports, 
airlines, and the Clearinghouse, each with well-defined roles, it’s a 
model, we believe, for other programs and industries. And I’ve got 
some further information on that I’d like to add to the record, if 
I could. 

Finally, Mr. Chairman, while not on point for this hearing, I do 
not want this opportunity to pass without a brief mention of an- 
other program over which the Committee has jurisdiction, the 
Aviation Trust Fund. 

The Administration’s budget request of earlier this week is seri- 
ously flawed from the perspective of the Nation’s airports. As this 
Committee knows, as the author of the Aviation Trust Fund, it was 
originally designed to collect taxes from passengers for capital de- 
velopments of the system, not for operations. The recent budget re- 
quest turns that fundamental priority of the Trust Fund on its 
head, requesting large-operations budget increases while slashing 
the capital-improvement programs almost $1 billion from the AIP 
program from the level authorized by this Committee. We think 
such cuts are unwise and shortsighted, and we hope that the Com- 
mittee will agree and fight to fully fund the capital programs. 

Thank you, Mr. Chairman. 

[The prepared statement of Mr. Barclay follows:] 

Prepared Statement of Charles Barclay, President, American Association of 

Airport Executives 

Thank you for the opportunity to share with the Committee the views of the air- 
port community on Transportation Security Administration aviation passenger pre- 
screening programs, including the Registered Traveler and Secure Flight programs. 
I am testifying today on behalf of the American Association of Airport Executives 
(AAAE), Airports Council International — North America (ACI-NA), and our Airport 
Legislative Alliance, a joint legislative advocacy organization. AAAE represents the 
men and women who manage primary, commercial service, reliever, and general 
aviation airports. ACI-NA represents local, regional and state governing bodies that 
own and operate commercial airports in the United States and Canada. 

Registered Traveler, Secure Flight Effectively Focus Limited Resources on 
Greatest Risk 

Let me begin. Chairman Stevens and Co-Chairman Inouye, by thanking you for 
your continued focus on the operations and priorities of the TSA. The programs the 
Committee has selected to examine today in the area of passenger pre-screening 
hold enormous potential in improving the effectiveness and efficiency of security 
screening operations at airports across the country. With aviation traffic returning 
to record levels and with Federal resources becoming ever scarcer, it is imperative 
that we get the most out of every dollar we devote to security. Utilizing better tech- 
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nology — such as Registered Traveler and Secure Flight — to effectively manage risk 
results in better security and a more efficient use of Federal and industry invest- 
ments. 

In our view, one of the key components to improving passenger screening is shift- 
ing the focus from finding dangerous “things” to finding dangerous “people.” The 
most important weapon that the 19 terrorists had on September 11 wasn’t box cut- 
ters; it was knowledge — knowledge of our aviation system and existing security pro- 
tocols, which they used to their advantage. We simply must do more to identify po- 
tential threats. Secure Flight offers opportunity in that regard, although we recog- 
nize that it must be pursued with careful consideration provided to a full range of 
individual privacy issues. 

Additionally, we must quickly take advantage of the opportunity that exists 
through deployment of a Registered Traveler program to more effectively calibrate 
the resource allocation at airport screening checkpoints. With more than 700 million 
passengers traveling through the U.S. aviation system each year — a number that is 
anticipated to grow to more than one billion annually within the next decade — we 
simply must take a better approach to security screening. Relatively few passengers 
make up the overwhelming majority of all travel, and we should make every effort 
to provide a different screening protocol for this group of travelers. Doing so will 
help expedite the screening process for all travelers and allow screeners to focus 
more intensely on unknown and potential threats. 

Our challenge with regard to passenger screening remains to find the proverbial 
needle in the haystack. Registered Traveler can help reduce the size of the haystack, 
and Secure Flight can help ensure that more resources are devoted to finding the 
needle. Both goals are important, and both programs deserve the continued support 
of Congress and the TSA. 

Along those lines, we are extremely encouraged by the leadership that Depart- 
ment of Homeland Security Assistant Secretary Kip Hawley has provided since tak- 
ing over the helm of TSA and believe that he deserves a great deal of credit for rec- 
ognizing the promise of these programs and for working to expedite their implemen- 
tation. On Registered Traveler, in particular. Administrator Hawley has moved the 
program past the “pilot” program phase and announced a timeline for making a na- 
tionwide, interoperable program a reality by this summer. It is our sincere hope and 
expectation that the announced timelines will be met, and we look forward to con- 
tinuing our work with TSA and the Congress to ensure that is the case. 

Public/Private Partnerships Have Proven Effective and Should Be Further 
Utilized 

While the Federal Government obviously plays a leading role with regard to pas- 
senger pre-screening and other areas of aviation security, airports and the aviation 
industry can and should play an active role in partnering with the Federal Govern- 
ment to design and implement meaningful solutions to security challenges. The es- 
tablishment of effective public/private partnerships has already proven extremely 
successful, for example, in building a system for processing fingerprint-based back- 
ground checks and additional background screening for more than 1.9 million air- 
port and airline employees through the Transportation Security Clearinghouse. We 
believe that the public/private model offers one possible solution in the areas under 
discussion today. 

On the Registered Traveler front as I will discuss in more detail, the representa- 
tives of the airport community and its aviation partners have proposed a public/pri- 
vate model that will be both interoperable and innovative. Undoubtedly, the best 
path forward is one in which Federal resources and standards are combined with 
the knowledge, expertise and creativity of airports, airlines and aviation-oriented 
businesses. 

Secure Flight Is Critical Tool in Identifying Dangerous People 

While the majority of my comments today are focused on Registered Traveler, I 
would like to highlight the critical nature of the Secure Flight program and to urge 
the Committee’s continued support. While there are critical privacy issues that must 
be addressed, it is indisputable that the more we know about individuals traveling 
through the aviation system, the more secure it will be. In today’s high-threat 
world, we must all recognize that the Constitutional right to privacy that we enjoy 
as Americans does not provide a right to anonymity. 

Knowledge is power and the more we know about potential threats before they 
have a chance to proceed to a security checkpoint or board a plane, the better off 
we all will be. Secure Flight adds yet another critical layer of security to the system 
and ensures that we don’t rely solely on physical screening to identify those who 
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seek to do us harm. Once privacy protections are ensured, the Federal Government 
can and should move forward with Secure Flight as soon as possible. 

Registered Traveler Program Will Improve Seeurity and Efficieney at 
Airports 

Before discussing some of the specific efforts of airports to partner with TSA in 
making Registered Traveler a reality, it is important to highlight again the value 
of a nationwide program and to remind the Committee of the strong endorsement 
the concept received from the 9/11 Commission and numerous others. In an era of 
risk management, limited Federal resources must be focused on known and un- 
known risks to the aviation system. Registered Traveler accomplishes that goal by 
helping TSA to better align screeners and resources with potential risks. 

Given existing traffic levels and anticipated system growth over the next decade, 
we simply must take a smarter approach to passenger screening. Today’s personnel- 
dependent screening system is already being pushed to the brink. One can only 
imagine what the situation will become as 300 million or more additional pas- 
sengers are added to the system. 

While a nationwide Registered Traveler Program will be open to all whom are eli- 
gible, there is no doubt that the frequent fliers who make up the overwhelming ma- 
jority of all travel will be the ones most likely to enroll. By providing a different 
screening protocol for this group of registered and scrutinized travelers — which we 
believe is a critical component of the program moving forward — TSA will be able to 
better target security resources, expedite processing for all passengers and reduce 
the passenger “hassle factor.” 

We have learned a great deal from the recently concluded Registered Traveler 
pilot programs that involved five airports partnering with a single air carrier at 
each airport. Although the original TSA pilot programs were popular with partici- 
pants, they were not interoperable by design, which limited benefits to only one air 
carrier at each of the five original airports. Additionally, participants largely were 
subjected to the exact same security protocol — the removal of laptops, shoes, and 
coats were still required, for example — as non-participants, meaning that the only 
real benefit was being moved to a shorter screening line with limited secondary 
screening. 

Moving forward, it is clear that in order to realize the true potential of Registered 
Traveler, the program must be nationwide and interoperable. Participants who sign 
up in phoenix, in other words, must be recognized and accepted as they travel to 
other airports that have chosen to participate in the program, be it Denver, Atlanta, 
Washington or other airports throughout the aviation system. Additionally, security 
screening protocols should be adjusted for program participants in recognition of the 
extensive background vetting they have received. Passengers who are willing to pro- 
vide substantial background information and undergo government security threat 
assessments should be accommodated with tangible screening benefits, such as non- 
divestiture of shoes, outer garments and laptops. 

As TSA proceeds with implementation of the Registered Traveler program, it is 
also important to note several potential pitfalls that the Federal Government must 
work to avoid. First, Registered Traveler cannot be viewed within DHS and the Fed- 
eral Government as simply a way to save money or to compensate for insufficient 
screening resources. At its core. Registered Traveler is a security-based program 
that will augment other screening efforts and better focus resources. It cannot be 
used as an excuse to shortchange other screening needs. To that end, we again call 
on TSA to issue and publish performance standards for security screening that 
apply to all screening locations. 

Additionally, the Federal Government must ensure that all data collected in con- 
junction with Registered Traveler is fully secure. TSA needs robust safe^ards to 
protect proprietary data it will collect through the program’s implementation. Such 
assurances are critical to ensure participation by the traveling public. Potential Reg- 
istered Traveler program participants have a right to expect that these issues will 
be addressed before implementation just as all individuals have a right to expect 
that privacy issues will be addressed before Secure Flight becomes operational. 

Finally, all fees associated with program participation must be transparent, cost- 
based, and kept to a minimum. The cost component is critical if we expect this vol- 
untary program to work as promised. 

Airport Registered Traveler Interoperability Consortium (RTIC) 

As I now turn to the Registered Traveler Interoperability Consortium (RTIC), I 
would note that ACI-NA is not a party to the RTIC process. As such, the following 
comments on the consortium reflect only those of AAAE and are specific to the 70 
airports and 40 service providers that participated in the RTIC process. 
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Airports, in light of their public nature and responsibilities to the communities 
they serve, remain eager to partner with the TSA to improve the effectiveness and 
efficiency of the security screening process. In recognition of the promise that Reg- 
istered Traveler in particular holds in achieving these goals, airport professionals 
have been working diligently to move forward operationally with the program. The 
RTIC represents one voluntary initiative focused on that goal. 

The RTIC is a group of more than 70 airports and 40 service providers that have 
worked for the past six months to define and establish the mutual and common 
business practices and technical standards that will complement Federal standards 
and help push forward a national program. RTIC represents a significant attempt 
by a large group in the airport community to partner with TSA in making the prom- 
ise of RT a reality as quickly as possible. 

The goal of the RTiC has been to develop a common set of business processes and 
technical rules on an open, secure and industry-driven network among airports that 
will create a fair and seamless platform for airports, airlines and vendors to inter- 
face with DHS and each other. Rather than pre-ordaining any one proprietary sys- 
tem, this open-architecture approach ensures that airports have an opportunity to 
work with any number of technologies or vendors to design a system that works best 
at their facility. This approach also ensures that the creativity and competition of 
the private sector is unleashed to better serve local needs and to keep program costs 
in check. 


Current Airport Members of the RTIC Include the Following Arranged by Size 
(Enplanements) Based on Calendar Year 2004 Data 


Hartsfield-Jackson Atlanta International Airport 

Denver International Airport 

Phoenix Sky Harbor International Airport 

John F. Kennedy International Airport 

Minneapolis-St. Paul International Airport 

George Bush Intercontinental/Houston Airport 

Detroit Metropolitan Wayne County Airport 

Newark Liberty International Airport 

Orlando International Airport 

Miami International Airport 

Seattle-Tacoma International Airport 

Philadelphia International 

Boston Logan International Airport 

New York La Guardia 

Washington Dulles International Airport 

Baltimore-Washington International Airport 

Fort Lauderdale/Hollywood International Airport 

Ronald Reagan Washington National Airport 

Pittsburgh International Airport 

Lambert-St. Louis International Airport 

Memphis International Airport 

Nashville International Airport 

William P. Hobby Airport 

Austin-Bergstrom International Airport 

Palm Beach International Airport 

General Mitchell International Airport 

Port Columbus International Airport 

T.F. Green State Airport 

Reno/Tahoe International Airport 

Ted Stevens Anchorage International Airport 

Manchester Airport 

Tucson International Airport 

Louisville International-Standiford Field 

Albany International Airport 

Lihue Airport 

Gerald R. Ford International 


Des Moines International Airport 
McGhee Tyson Airport 
Wichita Mid-Continent Airport 
Palm Springs International Airport 
Tallahassee Regional Airport 
Huntsville International-Carl T. Jones Field 
Lexington Blue Grass Airport 
Atlantic City International Airport 
Northwest Arkansas Regional Airport 
Newport NewsAVilliamsburg Int’l Airport 
Santa Barbara Municipal Airport 
Fort Wayne International Airport 
Daytona Beach International Airport 
Roanoke Regional/Woodrum Field 
Bangor International 
Yeager Airport 
Wilmington International 
Chattanooga Lovell Field 
Kalamazoo/Battle Creek International Air- 
port 

Jackson Hole Airport 
Cherry Capital Traverse City Airport 
Monterey Peninsula Airport 
Lafayette Regional Airport 
Redmond Roberts Field Airport 
Grand Forks International Airport 
Waco Regional Airport 
Redding Municipal Airport 
Greater Rockford Airport 
St. George Municipal Airport 
Flagstaff Pulliam Airport 
Barkley Regional Airport 
Tupelo Regional Airport 
Pullman/Moscow Regional Airport 
Mid-Ohio Valley Regional 
Shenandoah Valley Regional Airport 
Dickinson-Theodore Roosevelt Regional Air- 
port 


For the past six months, members of the RTIC have been working diligently to 
establish and agree on common core principles that will enable technical interoper- 
ability across a broad and varied airport network. In comments filed with TSA in 
late January in response to the Agency’s Request for Information on the Registered 
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Traveler program, RTIC and its Service Provider Council provided a detailed series 
of agreed upon financial standards, technical interoperability standards and com- 
mon business processes for the program. 

These recommendations provide a consensus framework for rapid, secure, and 
seamless deployment of a Registered Traveler program at the Nation’s airports that 
will result in enhanced security and quicker security processing. It is our hope that 
these consensus recommendations will be adopted by TSA as the agency moves for- 
ward with program implementation. 

While we would be happy to offer the Committee details on the RTIC filing with 
TSA, we wanted to simply summarize those efforts here. With regard to common 
business processes, the RTIC has identified each of the key players in a national, 
interoperable RT program — enrollment service providers, verification service pro- 
viders, the Registered Traveler Management System, TSA, applicant and partici- 
pant — and detailed the potential roles and responsibilities of each. On technical 
operability, the RTIC has made specific technical recommendations on system mes- 
saging, ensuring a chain of trust, optimizing the use of biometrics, leveraging appro- 
priate token technologies, ensuring system security, protecting privacy, and ensur- 
ing cross-provider interoperability. In the area of financial standards, RTIC has pro- 
posed a simplistic and straight-forward approach to enabling the meiximum flexi- 
bility and competition for solutions for both enrollment and verification service pro- 
viders. 

The RTIC is committed to working closely with TSA to meet the timeline estab- 
lished by the agency and its pledge to: use a public-private partnership model, build 
off of existing security networks through utilization of the Transportation Security 
Clearinghouse, establish a sustainable, biometrically enabled and interoperable sys- 
tem, and establish a program where travelers will receive screening benefits 
through in-depth background checks. 

By establishing a sustainable and cost-driven approach in partnership with TSA, 
airports can help ensure a Registered Traveler program that focuses on enhanced 
security above all else in addition to expediting the travel experience. These two pil- 
lars are the primary values that the Nation’s frequent air travelers want and that 
each of you as policymakers rightly will demand. By bringing efficiency back into 
the Nation’s airport screening checkpoints, TSA screeners will be able to better 
focus their limited resources on the critical task of providing more rigorous screen- 
ing to individuals about whom we know less than those who have voluntarily sub- 
mitted their background for extensive vetting and clearance. 

As frequent travelers, each Member of this Committee knows that every airport 
is unique. A successful, long-term Registered Traveler Program depends on the im- 
plementation of a technical, operational and business model capable of supporting 
individual airport needs, while providing the common infrastructure that allows 
passengers to use this capability at any airport nationwide. In recognition of that 
fact, it is critical that a permanent Registered Traveler Program be airport-driven 
and run largely outside of government with careful and consistent government back- 
ground checks, standards and oversight. 

Mr. Chairman, more than four years after the tragic events of September 11, we 
still have a great deal of work to accomplish in transforming the existing personnel- 
dependent screening system into the system of the future. In an era dramatically 
increasing demands on our Nation’s air transportation system, it is critical that we 
move forward as quickly as possible with promising technology like Secure Flight 
and Registered Traveler. Airports and the aviation industry have a key role to play 
in working with the Federal Government, and we are pleased to report great 
progress in that regard. It is our sincere hope and expectation that the Federal Gov- 
ernment will continue to fulfill its responsibilities so that these programs can be- 
come a reality in the very near future. 

Again, we appreciate the leadership of this Committee and the opportunity to tes- 
tify today. 


Additional Information Submitted by Charles Barclay 

Airport Magazine, May/June 2005 Issue 

Inside TSC: Saving Money, Saving Time 

Compiled From AAAE Staff Reports 

A dramatic reduction in fingerprint processing time from 52 days to four hours 
that saves the aviation community hundreds of millions of dollars annually resulted 
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from advances in technology and customer service developed by AAAE’s Transpor- 
tation Security Clearinghouse (TSC) in its scant three years of existence. 

Lori Beckman, A.A.E., security director at Denver International Airport, offered 
this assessment: “The TSC has been instrumental in decreasing the CHRC (criminal 
history records check) processing time and dramatically improving customer service. 
Another benefit is the TSC stores the fingerprint data submitted, which we will be 
able to use in the future for recurrent checks, thus eliminating the need to re-finger- 
print employees.” 

Brian Thompson, operations director at Yuma (Arizona) International Airport, 
agreed, stating that, “Turnaround times on fingerprint submissions and results 
have decreased significantly over a short period of time, a testament to the success 
of the TSC.” 

The TSC was born in the aftermath of the September 11, 2001, terrorist attacks 
against the United States when FAA mandated that a criminal history records 
check be initiated on every individual employed in or applying for a position in se- 
cure areas of U.S. airports. Realizing that the Federal system in place at that time 
for conducting records checks — which took 52 days or longer to process fingerprint 
submissions — wouldn’t meet the test, FAA signed an agreement with AAAE to facili- 
tate fingerprint processing for aviation employees. 

AAAE developed the TSC process over the past three years, using technical and 
administrative innovations that would save the aviation industry valuable dollars 
as well as time. Once established, the TSC was able to reduce the time it took for 
the aviation community to receive fingerprint results from months to an average of 
four hours, with most reports completed in 40 minutes. 

Regardless of the size of airport, the TSC has enabled airport and airline employ- 
ees to begin a new job or return to work quickly without delays caused by obtaining 
security clearances, thus virtually eliminating the problem of lost productivity. As 
Sgt. Carlos Garcia at San Antonio International Airport explained, “The entire staff 
at the TSC has always been able to provide answers and provide suggestions and 
solutions in a very timely manner to the multiple problems my office has encoun- 
tered while attempting to comply with TSA (Transportation Security Administra- 
tion) fingerprint requirements. The TSC has provided the logistics for the airports 
to comply with the TSA fingerprint mandate in a professional and very helpful man- 
ner.” 

Airlines as well as airports have been positive in their assessment of the TSC. 

Darby James, senior manager-staffing administration for Continental Airlines, re- 
called the TSC’s challenge: “They had the burden of bringing a flow to the process 
and there was very little room for error. It seemed the clearinghouse had taken on 
a responsibility they were not equipped to handle. The Air Transport Association 
held numerous conferences to discuss air carrier frustrations. In one conference. 
Continental requested a representative from AAAE attend and answer some of our 
questions and concerns. It was clear from this meeting that AAAE understood their 
responsibility and were working hard to make improvements. In 2002, we began 
seeing marked improvement from AAAE. They listened to our concerns, made im- 
provements based on our suggestions and the process started to pick up speed. The 
time it takes to receive results has gone from nearly three months to 24 hours and 
in some cases, we receive results within hours. AAAE overcame a seemingly insur- 
mountable task. Their efficiencies translate into millions of dollars in savings for the 
air carriers and airport operators.” 

Northwest Airlines said that, due to the TSC, the carrier has “significantly re- 
duced our new employee processing costs and decreased the time it takes to perform 
one of our background checks.” Southwest noted the TSC’s successful efforts “to 
streamline and improve the fingerprint based criminal history record checks proc- 
ess.” The carrier added that, “We have noticed a marked improvement in the turn- 
around time for receipt of CHRC results since the TSC took over as the fingerprint 
submission clearinghouse for airlines and airports.” 

In addition to significant improvements in fingerprint processing times, the TSC 
has one of the lowest per record error rates — 2 percent compared with the 8 percent 
average Federal rate. This allows employees to keep on working, without the need 
for repeat trips to the badging office. Further, the TSC facilitated the first high- 
speed secure connection to the Federal fingerprint processing system and, through 
other technology improvements, allowed the TSA to lower electronic fingerprint 
processing prices to the aviation community. The TSC continues to work with TSA 
to offer the aviation industry even lower processing prices. 

Effective and timely customer service by TSC employees helps to resolve mistakes 
made in fingerprinting at the airport or airline level before they turn into delays 
at the Federal level. 
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Laura Hoke, an airport security and public safety official at San Diego Inter- 
national Airport, offered the TSC staff praise for a “helpful attitude” and “prompt 
resolutions to our problems.” In addition, Hoke stated, “You always take the time 
to be patient, help figure out what the problems are and get them resolved quickly. 
Your dedication to customer service is admirable.” 


The TSC Explained 


Created in December 2001, the Transportation Security 
Cleoringhouse (TSC) provides one centrol location (or managing 
the legolly mondoted tosk of checking the criminal history back- 
grounds of airport and oirline employees. TSC established o 
quick ond secure method for collecting fingerprints from more 
than 500 oirports, airlines and other organizations across the 
country ond transmitting them to the FBI for processing. TSC also 
collects user payments and provides customer service. 

To meet the requirements outlined under the Aviation and 
Tronsportation Security Act and heightened demand related to 
aviotion industry employee background checks, TSC: 

• provides expedited processing and resolution of finger 
print-bosed and nome-based checks through required 
federol chonnels; 

* performs quolily assurarv:e checks on all inbound ond 
outbound fingerprint submissions; ond 

« offers centrolized billing tied to record submittals; 


* ollows regulated entities to submit fingerprints either 
electronically or on cords; 

* ensures secure handling of investigation results; 

* permits only air corriers and airports to view 
investigation results; 

* provides accounting reconciliolion services; 

* facilitates occess to troining expertise, and assists the indus 
try in purchasing; electronic fingerprinting equipment ; and 

* facilitates resubmission of fingerprints for the regulated porfy, 

TSC has taken a number of steps to make the process os easy 
ond efficient os possible (or the aviotion industry. For instonce, it 
created the first high-speed, secure connection to the federal fin- 
gerprint processing system and set up and brought online more 
thon 500 seporate submitting entities for fingerprint processing. 
TSC hos hondled more thon 1 .6 million fingerprint records, pro- 
cessing them and passing them on to the federal government in 
on overage time of 16 minutes per record. 


While aviation companies have benefited from the TSC’s productivity advance- 
ments, commercial truckers who are appl3dng for endorsements to carry hazardous 
materials (hazmat) are paying steep fees and taking weeks or months to obtain 
CHRC results, according to the American Trucking Associations (ATA). 

Daniel England, CEO of C.R. England, Inc. trucking company, testified on behalf 
of the ATA at a May 11 hearing of the House Transportation and Infrastructure 
Subcommittee on Highways, Transit and Pipelines. “At a time when carriers are 
struggling to attract qualified drivers — and I want to emphasize that; it’s one of the 
most serious problems we have — and freight volumes are up, TSA has imposed upon 
the industry an unwieldy fingerprint process that discourages drivers from obtain- 
ing hazardous materials endorsements,” England told panel members. 

England pointed to several failures in the process mandated for truckers: 


• As of March 4, 2005, a month after the requirement had gone into effect for 
new applicants for hazmat endorsements, Illinois had submitted 644 fingerprint 
requests and received no responses from TSA; 

• New York had submitted 350 fingerprint requests and received no responses; 

• Vermont had submitted 10 fingerprint requests and received no responses; 

• Iowa had submitted 138 fingerprint requests and received no responses; 

• Mississippi had submitted 100 fingerprint requests and received zero responses; 

• Kansas had submitted 150 fingerprint requests and received 40 responses; 

• Florida had submitted 700 fingerprint requests and received 14 responses. 


Several states are implementing the hazmat regulation unevenly, highlighting the 
problem with lack of uniformity, England stated. “Although the fingerprint require- 
ment for renewals and transfers does not take effect until May 31, 2005, several 
states were stripping the hazmat endorsement from drivers who moved from one 
state to another, thus making them ineligible to haul hazardous materials loads 
until TSA processed the results of their background checks. Since a large number 
of carriers require drivers to have hazardous materials endorsements as a condition 
of work, these workers are eventually unable to work for a period of time,” he said. 

Although some of these problems have since been addressed, “It is unconscionable 
that these problems were allowed to detrimentally affect drivers’ livelihoods and 
carriers’ business for months after the program went into effect,” England testified. 
“There are problems that the trucking industry still faces today that do not appear 
likely to be corrected in advance of May 31. In its analysis of its regulation, TSA 
estimated that there would be a 20 percent reduction in the number of drivers with 
hazardous materials endorsements. If the reduction is a result of individuals who 
are identified as threats being excluded from the transport of hazardous materials, 
then so be it. However, ATA cannot stand idly by if the reduction is attributable 
to a poorly designed process that dissuades drivers from seeking or renewing their 
hazardous materials endorsements. At a time of driver shortage, I would argue that 
the Nation’s economy cannot afford this process to continue.” 
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Todd Zinser, DOT deputy inspector general, told lawmakers at the same hearing 
that the TSC has completed more than 1.6 million fingerprint-based background 
checks since it began operations in January 2002. “While initially a concern, the 
issue of timeliness turned out to be a non-factor,” Zinser said. “In that case, the 
American Association of Airport Executives served as a clearinghouse to facilitate 
the process of fingerprints for the airports and airlines. Since TSA is no longer part 
of the department, we do not have firsthand knowledge of how TSA is implementing 
the program or whether the experience at the airports provide any lessons to the 
hazmat endorsement rule,” he added. But based on our observations at airports and 
airlines, strong cooperation among all stakeholders is absolutely critical to make the 
process efficient and effective.” 

The establishment of the TSC as the central location for processing and tracking 
fingerprint submissions also has resulted in numerous productivity enhancements 
that have allowed TSA to lower electronic fingerprint processing prices to the avia- 
tion community. 

While hazmat truckers pay nearly $100 per person for fingerprint processing. Rep. 
Peter DeFazio (D-Ore.) pointed out that aviation industry employees using the TSC 
pay far less for more efficient processing. DeFazio told panel members that TSC 
“has more integrity and it’s more efficient and they’re apparently somehow either 
breaking even or making money on it at $29. And they’re accessing the same data- 
base, which costs $22 so their processing cost is $7.” 

At another point in the hearing, DeFazio noted that the hazmat trucker back- 
ground check “is a Federal certification for national security purposes.” He asked, 
“Could we not go to a system like is being used in aviation, which works very well?” 

For the future, the TSC has outlined plans to offer enhanced services to help the 
aviation industry meet its security challenges. In 2003, the TSC began offering En- 
hanced Background Screening Services (EBSS). Through EBSS, airports and air- 
lines are able to verify the identity of individuals, complete criminal history checks, 
obtain driving records, and validate employment history, professional credentials, fi- 
nancial status and immigration status. These services have allowed airports and 
companies to answer questions about an individual’s criminal history left unresolved 
by fingerprint checks done by the Federal Bureau of Investigation, as well as to ex- 
amine other aspects of an individual’s background relevant to assessing a job appli- 
cant’s trustworthiness. 

“TSC has developed a unique and enviable record of success in bridging non-Fed- 
eral and Federal biometric-based background checks,” said AAAE President Charles 
Barclay. “It has the processes, custom software and customer service focus needed 
for today’s fast-moving work environment. TSC will not only continue to play a key 
role in CHRC for aviation workers, but will also be increasingly important for pro- 
grams like Registered Traveler, TWIC and others that need to move forward and 
value speed,” he said. 

“AAAE, its members and its customers have made a significant investment to get 
this right for aviation, because the difference between months and hours for these 
checks has enormous implications for personnel costs in aviation,” Barclay said. “We 
are eager to share the knowledge and systems we have carefully honed with other 
biometric credentialing programs in aviation and other industries.” 


Transportation Security Clearinghouse 

Industry -driven Federal partnership dramatically increases security and saves indus- 
try hundreds of millions of dollars 

AAAE has recognized a new milestone in their successful security partnership 
with DHS. The Transportation Security Clearinghouse (TSC), a unique public-pri- 
vate partnership charged with strengthening the security and efficiency of aviation 
employee background checks, surpassed 1.8 million fingerprint-based background 
checks successfully completed. Since its creation in December 2001, the TSC has 
processed 1.8 million criminal history record checks for airport and airline employees 
and has saved the airport and airline industry both time and money through its 
commitment to efficiency and technological innovation. 

In fact: 

• The TSC process has reduced the time it takes for airports to get fingerprint 
results from an average of 52 days, pre-September 11, when submitting to 
0PM, to an average of 4 hours, with most reports completed in around 40 min- 
utes. This reduction in time has enabled airports to put their employees on the 
job where they are needed, without the need to pull another valuable employee 
from their duties to serve as an escort. The TSC has saved the industry hun- 
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dreds of millions of dollars in productivity gains and employee retention as a 
result of reduced fingerprint check processing times. 

• Because of innovative in-house technical work, the TSC performs “real-time” 
processing to transmit fingerprints to the Federal system in an average of 16 
minutes. The TSC’s “real-time” processing dramatically increased the efficiency 
and timeliness of the airport fingerprint submission process. 

• Centralization of the fingerprint tracking process allows for accurate fingerprint 
submission status at any point in the background check process virtually elimi- 
nating “lost fingerprints” within the Federal system. Ensuring that airport em- 
ployees can return to work and not have to be called back for repeated 
fingerprinting due to missing fingerprints. This centralized process has saved 
airports thousands of wasted employee work hours over the last three years. 

• The TSC is paid by and works for the airports and airlines conducting employee 
checks, not by TSA. This affords the TSC the opportunity to make quick changes 
on behalf of airports without having to worry about going through burdensome 
TSA approvals for every change it makes to its process. 

• TSC provided an industry first Virtual Private Network (VPN) connectivity for 
fingerprint submissions. This innovative approach which was provided by the 
TSC to airports free of charge connects the livescan devices at the airports to 
the TSC and currently saves some airports over $1,000 a month in long distance 
telephone charges. 

• Because of AAAE’s ability to do the technical and administration work “in- 
house” and subsidize labor and other costs for the formation of the clearing- 
house, the resulting cost savings allowed TSA to lower fingerprint processing 
prices from $31 to $29 (for electronic submissions), saving the industry over $3 
million dollars. The TSC has been working with TSA to reduce the processing 
fee to an even lower rate. 

• EBI indicates that the submissions of the aviation community done through the 
TSC had one of the best error rates in the U.S. (2 percent) and that this reduced 
error rate was directly related to the quality checks and error corrections per- 
formed by the TSC. The current Federal average error rate is 8 percent. Since 
the TSC began operations, the error rate has continued to decline, with a sig- 
nificant drop when the TSC brought its “in-house” developed software package 
online. This equates to approximately 32,000 aviation workers that did not have 
to go through the time consuming process of reprinting due to errors created 
at the airports’ print office with a cost savings of $2.5 million dollars to the in- 
dustry. The TSC also warehouses submitted fingerprints allowing correction and 
resubmission when errors occur between the TSA and FBI, saving industry val- 
uable time, effort and more importantly saved labor costs. 

The Transportation Security Clearinghouse (TSC) has been remarkably successful 
in providing one central location where the mandated task of checking the back- 
grounds of hundreds of thousands of airport and airline employees can begin. The 
TSC established a quick and secure method to collect employee fingerprints, user 
payment and offer customer service for over 500 airports and multiple airlines 
across the country for further processing by the FBI. 

As demonstrated above, the Clearinghouse has taken a number of steps to make 
the process as easy and efficient as possible for the aviation industry. We facilitated 
the first high speed secure connection to the Federal fingerprint processing system, 
set up and brought online over 500 separate submitting entities for fingerprint proc- 
essing and have served over 1.8 million fingerprint records that were passed on to 
the Federal Government for processing at an average speed of 16 minutes per 
record. 

The Clearinghouse is committed to continuous improvement and working with 
airports, airlines and government agencies on all the issues that impede a smooth- 
functioning criminal history record check process. 

The Chairman. Thank you very much. 

Our next witness is Tim Sparapani — I hope I’m saying that 
right 

Mr. Sparapani. That’s perfect. 

The Chairman. — legal counsel for privacy rights, American Civil 
Liberties Union. Please. 
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STATEMENT OF TIMOTHY D. SPARAPANI, LEGISLATIVE 
COUNSEL, AMERICAN CIVIL LIBERTIES UNION 

Mr. Sparapani. Good morning, Chairman Stevens, Co-Chairman 
Inouye, and distinguished Members of the Committee. 

The ACLU, representing its 600,000 members, respectfully sub- 
mits this testimony opposing Secure Flight and Registered Trav- 
eler. 

It’s time for Congress to decide that enough is enough. Secure 
Flight and Registered Traveler will not make us any safer, and 
they will certainly make us less free. Let me start with Secure 
Flight, and then turn to Registered Traveler. 

For 4 V 2 years, nearly 200 million wasted tax dollars, several 
name changes, and repeated unsuccessful modifications. Secure 
Flight is no closer to implementation today than when it was first 
proposed, shortly after 9/11. TSA’s repeated failures to launch Se- 
cure Flight suggests this program should be abandoned. 

While it seemed like a simple commonsense concept at first 
blush, attempts to implement Secure Flight demonstrated it is 
laden with unforeseen complexities, making it impractical, techno- 
logically difficult, and unlikely to improve our security. It also 
threatened civil liberties, and it’s a poor use of limited security dol- 
lars compared to other options. Simply put, it’s time to pull the 
plug. 

Let’s take one example: the redress procedure, which we’ve heard 
a little bit about this morning. No one questions the importance of 
establishing a procedure to help innocent Americans wrongly put 
on the “No-Fly” and “Selectee Lists” to get off, and stay off, the 
lists, yet, 4 years later, TSA still hasn’t developed one. 

If TSA cannot provide redress after 4 years, how can Congress 
have any confidence that TSA can build the rest of Secure Flight? 

Secure Flight suffers from one critical security weakness. No 
matter how it’s redesigned. Secure Flight will not stop a single ter- 
rorist from boarding an airplane, unless the terrorist tries to fly 
using their own name and documents. Unfortunately, as we all 
know, identity theft is all too common. 

Security dollars are, unfortunately, limited, so we must spend 
wisely. Since Secure Flight can’t make us safer. Congress needs to 
redirect TSA’s energies to programs more likely to save lives. The 
hundreds of millions Secure Flight will cost should be redirected to 
more effective, straightforward security that has fewer complica- 
tions for civil liberties, privacy, and the airlines. For example, 
many of your constituents might be surprised to learn that even 
now, not all carry-on bags, luggage, and cargo are screened for 
weapons and explosives. Congress should scrap these other pro- 
grams and invest in new, narrowly tailored technologies to get this 
screening done. 

Let me turn to Registered Traveler. Like Secure Flight, this con- 
cept seems commonsensical and appealing, at first blush. But, 
again. Registered Traveler opens up a snakes nest of complexities 
once you delve into rating Americans’ riskiness and sorting them 
into categories about how trustworthy they are. And this program’s 
security benefits remain unclear, because Registered Traveler can- 
not identify and stop terrorists who belong to a sleeper cell. 
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Every Registered Traveler supporter assumes that, of course, 
they will belong to the program. But, of course, some people will 
he denied, and other innocent Americans will be wrongly labeled 
too risky. No one, not Congress, not TSA, the companies pushing 
the program, or the ACLU, for that matter, knows the con- 
sequences for those wrongly denied participation. Will this create 
a third list of undesirable flyers, the “unregisterable travelers”? If 
so, will that list be used to automatically select someone for addi- 
tional intrusive scrutiny every single time they try to fly, or to 
deny a security clearance necessary for a job, or to enter a govern- 
ment building? If companies wrongly determine that an applicant 
is risky, what legal recourse will applicants have to challenge that 
finding and its consequences? 

Registered Traveler is flawed, from a security perspective, be- 
cause no one knows what criteria will distinguish innocent trav- 
elers from a sleeper-cell terrorist awaiting instructions to attack. 
It’s a flawed premise that, by checking a flyer’s commercial data 
background, the Government or a company can identify terrorists. 

Last fall. Congress decided commercial data was too often erro- 
neous to be useful to prescreen passengers for Secure Flight. It was 
the right decision, and Congress should do the same thing for Reg- 
istered Traveler by explicitly denying both TSA and participating 
companies commercial data to prescreen passengers. 

In conclusion, since neither of these programs will provide the 
enhanced aviation security that proponents promise, this Com- 
mittee should act now to prevent them being built at all, because 
they all pose unacceptable risks to civil liberties and personal pri- 
vacy. 

Extreme applications of either program that wrongly label an in- 
nocent American a risk could threaten a person’s constitutionally 
protected, Supreme-Court-ratified right to travel. We urge Con- 
gress to revoke TSA’s authorization for both programs. And let me 
reiterate that we’re eager to work with you to make flying safer 
and consistent with our constitutional principles. 

Mr. Chairman, this concludes my testimony, and I look forward 
to your questions. 

[The prepared statement of Mr. Sparapani follows:] 

Prepared Statement of Timothy D. Sparapani, Legislative Counsel, American 

Civil Liberties Union 

I. Introduction and Summary of Requests for Committee Aetion 

The Honorable Chairman Stevens and Ranking Member Inouye, the American 
Civil Liberties Union (“ACLU”), representing its nearly 600,000 members, respect- 
fully submits this testimony in opposition to the Secure Flight and Registered Trav- 
eler programs. 

After four and one-half years, nearly $200 million wasted tax dollars, ^ several 
name changes, and repeated, unsuccessful reformulations of the underlying pro- 
posals, Secure Flight and Registered Traveler are no closer to implementation than 
when they were first proposed shortly after the tragic events of September 11, 2001. 
First introduced as CAPPS II and Trusted Traveler, Secure Flight and Registered 
Traveler remain predicated on the unproven, theoretical, and flawed premise that 
the government can predict whether an individual will at some future date commit 
a terrorist act. The Secure Flight Working Group, convened by the Transportation 
Security Administration (“TSA”) to provide it with advice, concluded that 
“ . . . there is not sufficient available intelligence to determine what characteristics 
indicate someone will be a threat.” Secure Flight Working Group Rep., presented 
to the TSA, September 19, 2005, at 3. This premise, akin to alchemy and astrology 



60 


in its scientific accuracy, has led TSA to misdirect its resources towards establishing 
two passenger pre-screening programs that will not make us any safer but will 
make us less free. Attempts to establish these programs have served as massive di- 
versions that to this day prevent TSA screeners from accomplishing their core mis- 
sion. Congress can only draw one conclusion from the failure to build Secure Flight 
and the inherent weaknesses of Registered Traveler: authorizations for both pro- 
grams must be terminated expressly, and Congress must force TSA to refocus on 
achieving its core mission by keeping known terrorists who are threats to aviation 
security off planes, and — for the first time — screening all carry-on bags, luggage, 
and cargo for weapons and explosives. 

The ACLU requests that this Committee and Congress explicitly revoke author- 
ization for both Secure Flight and Registered Traveler, no matter what they are 
called, and instead insist that the Department of Homeland Security’s (“DHS”) TSA 
focus its passenger pre-screening on accomplishing two goals: (1) paring the No-Fly 
and Selectee Lists maintained by the Federal Bureau of Investigation’s Terrorist 
Screening Center (“TSC”) down to known terrorists who personally pose a specific 
threat to aviation security only; and (2) simply comparing passenger manifest lists 
to this refocused list. ^ 

If the TSA attempts to implement Registered Traveler, the ACLU requests that 
Congress expressly block the privatization of Registered Traveler and prevent the 
use of commercial data concerning applicants to determine whether a would-be flyer 
is qualified to sign up for Registered Traveler. Neither the government, nor compa- 
nies should assign individuals a risk assessment based on commercial data, because 
the consequences of a wrongful determination could lead to many future depriva- 
tions of the exercise of rights and privileges. However, it is significantly more inap- 
propriate to allow private companies to perform a governmental role to determine 
whether a passenger constitutes a threat and the Government still must act in a 
Constitutional manner, even if it has outsourced its responsibilities to the private 
sector. Companies cannot be trusted to make such determinations accurately. The 
consequences of such a negative determination would likely add the rejected appli- 
cant to a new third list — similar to the No Fly List or Selectee List — of undesirable 
flyers who are virtually certain to be subject to, at a minimum, extra scrutiny every 
time they attempt to fly, and, at worst, a permanent bar from flying altogether. As 
is discussed in greater detail below, this new third list of “Un-Register-Able trav- 
elers” would likely be shared with other Registered Traveler companies, the TSA, 
TSC, and, likely, other government agencies. Further, as Congress recognized last 
fall when it expressly prohibited the TSA from utilizing commercial data to pre- 
screen passengers for Secure Flight, commercial data contains enormous error rates, 
is unreliable, and is not useful as a tool to predict whether a would-be flyer is a 
threat to aviation security. ® 

II. Secure Flight: A Dangerously Flawed Proposal that Should Be Termi- 
nated 

Secure Flight, regardless of its form, permits unacceptable security weaknesses, 
while threatening civil liberties and personal privacy. It is hard to say for sure what 
Secure Flight will ultimately do since TSA has still not finalized a working plan, 
flow chart or business model for the concept. However, it appears that Secure Flight 
would: 

1) Require TSA to gather passenger name record (“PNR”) data from the airlines 
and travel agents who book tickets; 

2) Require TSA to forward this information to the Federal Bureau of Investiga- 
tion’s Terrorist Screening Center (“TSC”), to compare the names of the ticket 
purchasers to those names on the No-Fly and Selectee Lists; 

3) Require TSC to inform TSA whether a person attempting to fly is on either 
list; and 

4) Require TSA to tell its airport screeners to (a) allow the person to fly 
unimpeded except for normal screening, (b) select the person for some addi- 
tional and more intrusive screening, such as opening bags, patting the person 
down, screening for explosive residue, and/or detaining the person for ques- 
tioning, or (c) inform the would-be passenger that their name is similar to that 
of someone on the No-Fly list and they are barred from flying. 

While this concept appears easy to implement, it suffers from numerous and in- 
tractable problems. 

A. Security Weaknesses Render Secure Flight Unwise 

Secure Flight is fatally flawed from a security standpoint. To support Secure 
Flight, a person must accept the dubious premise that terrorists will attempt to 
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book a ticket and board a flight under their own names. This is a simplistic ap- 
proach and one upon which we cannot allow our airline security to rely. Again, no 
terrorists will be prevented from boarding airplanes unless a terrorist both attempts 
to book a ticket and shows up to board a plane under his or her own name and 
documents. The ease with which identity theft and document fraud is accomplished 
renders this premise highly suspect, however. The U.S. Federal Trade Commission 
estimated in 2003 that “over a one-year period nearly 10 million people — or 4.6 per- 
cent of the adult population — had discovered that they were victims of some form 
of identity theft.” Prepared Statement of the Federal Trade Commission before the 
Committee on Banking, Housing, and Urban Affairs, U.S. Senate on Identity Theft: 
Recent Developments Involving the Security of Sensitive Consumer Information, 
Deborah Platt Majoras, Chair of the Federal Trade Commission, March 10, 2005, 
available at http:! I www.consumer.gov I idtheft I pdf I ftc — 03.10.05.pdf. 

The intelligence community presumes that the Nation’s enemies, such as A1 
Qaeda, are: (1) patient; (2) well-funded; (3) capable of committing identity theft with 
remarkable ease; and (4) capable of producing high-quality, forged identification doc- 
uments that allow a terrorist to purchase tickets and present virtually undetectable 
papers under an assumed name. This programmatic weakness leads to what secu- 
rity experts dub False Negatives, an inability of Secure Flight to detect actual ter- 
rorists. If the system is not able to identify known terrorists, TSA’s screening will 
have failed. 

Again, the ACLU does not oppose the TSA vetting passenger lists against a nar- 
rowly constructed list of known terrorists who pose a specific threat to aviation se- 
curity. If a wanted terrorist is foolish enough to fly under his or her own name, the 
government should immediately arrest the suspect or monitor the terrorist’s activi- 
ties while preventing the terrorist from committing acts of terror and violence. 

The problem from a security and civil liberties perspective is that both the No Fly 
and Selectee Lists, which are at the heart of the Secure Flight proposal, are bloated 
with names of individuals who have absolutely no connection to terror and do not 
have the capability of threatening aviation security. This leads to numerous cases 
of False Positives, which distract TSA from finding the actual terrorists. False posi- 
tive stories are ubiquitous. Each Senator who is a Member of this Committee likely 
has innocent constituents who have been unnecessarily harassed, delayed or out- 
right denied the ability to fly. The ACLU has collected complaints from 1,000 of 
such constituents, 740 of which were gathered through our internet intake process, 
but we will highlight just four: 

• Passenger David XXXXX (Aug. 16, 2005) was surrounded by armed police with 
guns drawn at the ticket counter when he was mistakenly identified as being 
on the No Fly List. Moreover, when he arrived at the gate, his checked luggage 
was brought to him, and he was forced to witness the search of his belongings 
at the gate, the whole process taking two hours. 

• Passenger Gregory XXXXX (May 9, 2005), after having his luggage thoroughly 
searched, was separated from his five-year-old son who was hysterically cr 3 dng 
and escorted into a private room where he was subjected to a cavity search and 
genital inspection. Gregory has been wrongly delayed overnight on five separate 
occasions and whoever is accompanying him is also subject to delays and 
searches. 

• Passenger, Mary XXXXX (May 16, 2005) was forced by TSA screeners to be 
screened with a machine (Smiths Detection lonscan Sentinel II), which she was 
told checked “to see if I have a bomb inside me.” This machine photographed 
her and TSA denied her repeated requests to view the picture or be provided 
a copy. 

• Passenger Hussein XXXXX (July 23, 2005) is a Lebanese citizen who has been 
a legal resident of the U.S. since 1992. During his layover in Minneapolis, Min- 
nesota while fl 3 dng from Lebanon to Seattle, Washington, he was escorted off 
the plane by five security officers to a room away from the gate. He was ques- 
tioned about his family, extended family, how he files taxes, his business, his 
real estate holdings and so forth. Additionally, the officers demanded he give 
them access to his computer, which he initially refused because it contained 
confidential information about his clients. After five hours of interrogation, he 
was exhausted and delirious so the officers gave him a choice of either being 
detained overnight and being questioned the following day or having an appeal 
inspection in Seattle. He was scheduled to appear at the U.S. Customs and Bor- 
der Protection Office in Seattle on July 25, 2005. In the past, he has had similar 
experiences. For example, on October 3, 2004, he was stopped in Portland, Or- 
egon on his way to Frankfurt, Germany by U.S. Customs who interrogated him. 
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He was given no medical attention when he fainted, and security officers 
laughed at him while they waited until he regained consciousness. 

At least four Members of Congress — the Honorable Senator Ted Kennedy (D-MA), 
and the Honorable Congressmen Darrell Issa (R-CA), John Lewis (D-GA) and Don 
Young (R-AK) — have names similar to those of individuals on those bloated Lists. 
The Honorable Congresswoman Zoe Lofgren (D-CA) reported in Congressional hear- 
ings last summer that her husband has been repeatedly selected for additional secu- 
rity screening. Nuns and infants have been found on the No Fly List. To be effective, 
the Lists must be paired down only to known terrorists — not criminals, not deadbeat 
dads, not drug dealers. The advice provided by an independent panel of experts to 
the Department of Homeland Security concurs: 

Secure Flight should be narrowly focused. 

TSA should limit Secure Flight’s mission to correctly identify individuals in the 
traveling public who are on the Do Not Fly and Selectee lists. The case has not 
been made for any expansion of the mission of Secure Flight beyond identifica- 
tion of individuals on those lists. 

Department of Homeland Security Data Privacy and Integrity Advisory Com- 
mittee: Recommendation on the Secure Flight Program Rep., Adopted Dec. 7, 2005, 
at 2 (emphasis in original). Limiting the names on the list is the only way that TSA 
can focus on its core mission: preventing another terrorist attack on an airplane. 
Senator Kennedy (D-MA) revealed at a Senate hearing that due to the fact an “E. 
Kennedy” was on the No Fly List, Senator Kennedy repeatedly was selected for ad- 
ditional screening. Every minute spent treating Senator Kennedy like a potential 
terrorist is one less minute that could be spent catching the next Mohammed Atta. 

B. Civil Liberties: Secure Flight Leads to a Denial of the Right to Travel in Extreme 
Cases and Leads to Racial Profiling 

In addition to being fatally flawed from a security standpoint. Secure Flight also 
is flawed from a civil liberties standpoint. First, using a bloated No Fly List to pre- 
vent innocent people from fl 3 dng wrongly deprives them of their constitutionally pro- 
tected Right to Travel. The United States Supreme Court has stated that: 

The word “travel” is not found in the text of the Constitution. Yet the “constitu- 
tional right to travel from one State to another” is firmly embedded in our juris- 
prudence. United States v. Guest, 383 U.S. 745, 757, 86 S.Ct. 1170 (1966). In- 
deed, as Justice Stewart reminded us in Shapiro v. Thompson, 394 U.S. 618, 
89 S.Ct. 1322 (1969), the right is so important that it is “assertable against pri- 
vate interference as well as governmental action ... a virtually unconditional 
personal right, guaranteed by the Constitution to us all.” Id., at 643, 89 S.Ct. 
1322. (concurring opinion). 

Saenz v. Roe, 526 U.S. 489, 498-99 (1999). We suspect that TSA will soon begin 
to apply the Secure Flight concept to those who travel by train, interstate bus, boat 
and ferry. Some Americans living in remote regions of Alaska, or on the islands of 
Hawaii and Puerto Rico simply cannot drive to conduct their business, so the con- 
sequence for someone who is wrongly put on the No Fly List is severe and could 
force them to move to conduct their daily affairs. ^ 

Second, as too many Americans have experienced, people who are wrongly put on 
either list have no guarantee that they will be able to ever get off and stay off the 
lists. Establishing a transparent, workable redress procedure to help people wrongly 
listed should have been the first and easiest thing TSA accomplished. TSA has pro- 
vided numerous promises that such a redress process would be provided but, to 
date, has still not accomplished this goal: 

• “CAPPS H will include a comprehensive redress process for those passengers 

who have questions concerning their experience. TSA will appoint an Ombuds- 
man to handle any inquiries. These capabilities will result in improved resource 
scheduling and other operational efficiencies.” (March 7, 2003) Congressional 
briefing by Ben H. Bell, HI, Dir. Office of National Risk Assessment (“ONRA”) 
TSA, available at http: II www.acte.org ! initiatives ! 

CAPPS II CongressBriefing.pdf. 

• “CAPPS II will also include a comprehensive redress process for passengers. 
TSA will appoint a Passenger Advocate to work with our current Ombudsman 
program, to handle any inquiries or complaints raised by passengers with re- 
gard to the CAPPS II system. Where a passenger — of any nationality — believes 
that he or she is being improperly singled out for heightened scrutiny, this will 
be the place for this passenger to turn to have his or her concerns addressed. 
This is more than a matter of fairness — because CAPPS H is also a resource 
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allocation tool, it is in TSA’s interest to know where we are making mistakes. 
The Passenger Advocate will thus not only promote fairness and privacy and 
passenger confidence, but system effectiveness and efficiency.” (May 6, 2003) 
Statement of Stephen McHale to the European Parliament, Dep. Admin., TSA, 
available at http:! I www.europarl.eu.int I comparl I libe I elsj I events I hearings I 
20030506 / mchale speech.pdf 

• “The redress system is based on having an ombudsman and a passenger advo- 
cate designated and a process in place so that when an individual finds that 
they are being repeatedly selected as a secondary screenee during their transit 
through the airport that they will have an opportunity then to contact TSA, the 
ombudsman, and the passenger advocate and then we will have the capability 
to have a decision made at the TSA level concerning going in on that individual 
and then adjusting the criteria for that individual after we verify their name, 
date of birth, address to [sic] for into that and make these decisions, we think, 
in a rapid matter so that it is not a bureaucratic system of waiting forever to 
get a response. Our goal is to have a redress system that has flexibility in it 
and speed and scratches the itch for the traveling public regarding frustrations 
over being selected repeatedly.” (March 17, 2004) David M. Stone before House 
of Representatives Transportation Committee, Subcommittee on Aviation, avail- 
able at http:! / www.house.gov I transportation / aviation 1 03-17-04 1 stone.pdf. 

• “In addition, the new program [Secure Flight] will also include a redress mecha- 

nism through which people can resolve questions if they believe they have been 
unfairly or incorrectly selected for additional screening.” (August 26, 2004) TSA 
Press Release, available at http: II www.tsa.gov ! public ! dis- 

play?theme=44&content=09000519800c6c77. 

• “Before implementing a final program, however, TSA will create a robust re- 

dress mechanism to resolve disputes concerning the Secure Flight program.” 
(June 17, 2005) Lisa S. Dean, TSA Privacy Officer, Secure Flight Test Phase 
Privacy Impact Assessment, available at http: ! Iwww.tsa.gov ! interweb ! 
assetlibrary / Secure Flight SORN PIA.pdf 

• “In conjunction with the Secure Flight program, TSA has charged a separate 
Office of Transportation Security Redress to further refine the redress process 
under the Secure Flight program. The redress process will be coordinated with 
other DHS redress processes as appropriate. Utilizing current fiscal year fund- 
ing, resources have been committed to this Office to enable it to increase staff- 
ing and to move forward on this important work. TSA recognizes that additional 
work remains to ensure that there is a fair and accessible redress process for 
persons who are mistakenly correlated with persons on the watch lists, as well 
as for persons who do not in actuality pose a security threat but are included 
on a watch list. (June 29, 2005) Statement of Secure Flight Assistant Adminis- 
trator Justin Oberman to House of Representatives Subcommittee on Economic 
Security, Infrastructure Protection, and Cybersecurity, available at http:! / 
homeland.house.gov I files / TestimonyOberman.pdf. 

Yet, four and one-half years later, TSA has still not managed to accomplish this 
goal. Congressional frustration over this failure led, in part, to the express require- 
ment codified in both the FY 2005 and 2006 DHS Appropriations bills. Pub. L. No. 
108-774 §522(a), (d)-(f) (2004)5 and Pub. L. 109-90 §518(a)-(b) (2005)6 that the 
Government Accountability Office (“GAO”) certify the establishment of a working, 
fair redress procedure before Secure Flight can be implemented. As the GAO’s 
March 28, 2005 report regarding Secure Flight stated, TSA has failed to accomplish 
even this simple matter. U.S. Government Accountability Office Rep., Aviation Secu- 
rity, Secure Flight Development and Testing Under Way, but Risks Should be Man- 
aged as System is Further Developed (“GAO Report”), March 28, 2005, at 1. Just 
three weeks ago, DHS Secretary Chertoff and Secretary of State Rice issued a joint 
statement pledging the rollout of a workable redress process. ‘“One Stop’ Redress 
for Travelers. Sometimes mistakes are made. Travelers need simpler ways to hx 
them. Therefore, DHS and State will accelerate efforts to establish a government- 
wide traveler screening redress process to resolve questions if travelers are incor- 
rectly selected for additional screening.” Rice-Chertoff Joint Vision: Secure Borders 
and Open Doors in the Information Age. Department of Homeland Security, Depart- 
ment of State: Joint Press Release, Jan. 17, 2006, available at http:! ! 
www.state.govlrlpalprslpsl2006l59242.htm (emphasis in original). As too many 
Americans have experienced, and reported to the ACLU, the “passenger identity 
verihcation form” process TSA now utilizes is inadequate and does not guarantee 
that passengers will not be delayed or denied when trying to fly in the future. As 
the GAO reported, “. . . the effectiveness of the current redress process is uncer- 
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tain,” and “[t]he draft redress process documentation does not address a means for 
passengers who are inappropriately denied boarding to seek redress.” GAO Report 
at 56, 58. Thus, people whose names are wrongly added to the lists — or, more likely, 
have names similar to others on the Lists — are perpetually doomed to — at best — un- 
necessary harassment, embarrassment and delays every time they fly. At worst, 
they will be denied the ability to fly at all. Congress should ask: If TSA cannot build 
a redress process after nearly four and one-half years for Secure Flight to prevent 
against civil liberties violations, how can TSA be trusted to build an effective, civil 
liberties-respecting passenger pre-screening program? 

Secure Flight will likely lead to impermissible racial profiling. The names most 
likely to be on the No Fly and Selectee Lists that will be utilized for Secure Flight 
are likely to be those of Muslims, or people of Arab or Middle Eastern dissent. Thus, 
a disproportionate number of people who are wrongly selected for additional screen- 
ing or barred from flying outright will be those of these classes. Congress must 
guard against allowing a program designed to increase security from becoming a 
tool for racial profiling. Such profiling wastes precious resources and ignores the fact 
that the next terrorists may draw from those demographics that are the majority 
races, religions or ethnic backgrounds in this country. 

C. Privacy: TSA’s Failures to Safeguard Personal Data for Secure Flight Unaccept- 

ably Threaten Personal Privacy 

As demonstrated by the tortured attempts to test the viability of CAPPS II and 
Secure Flight, Secure Flight, if implemented, unacceptably threatens personal pri- 
vacy. Testing of Secure Flight has led to two high profile and massive privacy viola- 
tions. In 2003, JetBlue Airways gave 5 million actual passenger itineraries to Torch 
Concepts, a Defense Department contractor, which was attempting to study whether 
the government could prescreen passengers to determine who was a high-risk cus- 
tomer. Bruce Mohl, “Airlines Weigh Privacy Issues,” Boston Globe, Oct. 12, 2003. In 
a separate incident last summer, the GAO reported that TSA had violated the Pri- 
vacy Act of 1974, Pub. L. No. 93-579 (1974), codified at 5 U.S.C. §552, by giving 
personally identifiable information on millions of people without giving legally re- 
quired public notice. As stated by Senators Collins and Lieberman in a July 22, 
2005 press release and letter to Secretary of the U.S. Department of Homeland Se- 
curity Michael Chertoff, the GAO reported that “TSA failed to comply fully with the 
Privacy Act when it ‘collected and stored commercial data records even though TSA 
stated in its privacy notices that it would not do so.’” That letter further stated that 
a private contractor had “obtained more than 100 million records from commercial 
data aggregators in violation of the Privacy Act.” Senators Collins and Lieberman 
Criticize TSA for Violating Privacy Laws While Testing Passenger Prescreening Sys- 
tem: GAO Findings Conclude TSA Failed to Comply with the Privacy Act, July 22, 
2005, available at http:llhsgac.senate.govl 

index.cfm ?Fuseaction=PressReleases.Detail%PressRelease — id=106. 

Further, TSA has not learned from its privacy breaches; it has not yet even fully 
assessed the impact of implementing Secure Flight on passengers’ personal privacy 
despite a Congressional mandate. The GAO’s report regarding Secure Flight con- 
cluded that “TSA has not yet clearly defined the privacy impacts of the operational 
system or all of the actions TSA plans to take to mitigate potential impacts.” GAO 
Report, at 1. If past experience is the best guarantee of future performance, TSA 
cannot be trusted with the sensitive, private data it will demand from each pas- 
senger. The inability of the TSA to adequately safeguard sensitive, personally iden- 
tifiable information about actual passengers during testing of the program’s efficacy 
and viability provides no assurance that should the program be implemented each 
passenger’s information will be safeguarded. Indeed, if Secure Flight is imple- 
mented, the personal information of 1.8 million passengers on 30,000 flights will be 
electronically transferred from airlines and ticketing companies to TSA and TSC 
every single day. This will lead to numerous data breaches that dump sensitive in- 
formation into the public sphere. For identity thieves, it will be like taking candy 
from a baby. 

D. Track Record of Failure: Past TSA Failures Suggest Future Launch Efforts Will 

Not Be Better for Secure Flight 

Regardless of the security, civil liberties and privacy risks raised by what TSA’s 
public statements concerning Secure Flight suggest, the program remains wholly 
conceptual more than four years after passage of the Aviation and Transportation 
Security Act, Pub. L. No. 107-71 (2001), that authorized its creation. Slippage of 
deadlines has been the rule for Secure Flight and its predecessor CAPPS II: 

• “TSA expects to test CAPPS II this spring and implement it throughout the 

U.S. commercial air travel system by the summer of 2004.” TSA Press Release, 
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March 11, 2003, available at http: ! I www.tsa.gov ! public ! dis- 

play '?theme=44&content=090005 19800 193c2. 

• “Of note, the terrorist screening center remains on schedule to bring the first 
version of the consolidated terrorist screening database on line by March 31, 
2004, and achieve full operation capability by the end of the year.” Testimony 
of David M. Stone, before Hearing of House of Representatives Comm, on 
Transportation, Subcomm. on Aviation on status of CAPPS II, March 17, 2004, 
available at http:! / www.house.gov ! transportation ! aviation ! 03-17-04 ! 
stone.pdf. 

• ‘“We’re in great shape as we enter the testing phase’ of the program, Oberman 
said. He said if all goes according to plan, the new system will go into operation 
in late spring or early summer of 2005.” Wash. Post, Nov. 13, 2004, available 
at http:! I www.washingtonpost.com I wp-dyn I articles I A46610-2004Novl2.html. 

Every review by a government agency or independent commission in the last year 
found Secure Flight to be woefully undefined because of the myriad conceptual and 
practical flaws, no matter how the program is modified. 

• On March 28, 2005, the GAO summarized “TSA’s Status in Addressing Ten 
Areas of Congressional Interested included in Public Law 108-334,” finding that 
TSA had only achieved one of the ten requirements — establishing an internal 
oversight board — and had not yet even finalized a “draft concept of operations.” 
GAO Report, at 4. 

• On September 19, 2005, TSA’s Secure Flight Working Group concluded that: 
Congress should prohibit live testing of Secure Flight until it receives ... a 
written statement of the goals of Secure Flight signed by the Secretary of DHS 
that only can be changed on the Secretary’s order. Accompanying documenta- 
tion should include: (1) a description of the technology, policy and processes in 
place to ensure that the system is only used to achieve the stated goals; (2) a 
schematic that describes exactly what data is collected, from what entities, and 
how it flows through the system; (3) rules that describe who has access to the 
data and under what circumstances; and (4) specific procedures for destruction 
of the data. 

Report of the Secure Flight Working Group, Presented to the TSA, September 19, 
2005, at 32. 

• In August 2005, the Department of Justice’s Inspector General issued a report, 
which said that TSC could not plan to assist in Secure Flight because TSA 
failed to even establish a working flow chart for Secure Flight. “The TSC’s dif- 
ficulties in estimating the costs for Secure Flight are exacerbated by the TSA’s 
failure to specifically define the scope of each implementation phase. As a re- 
sult, the TSC has been unable to adequately project its resource requirements 
for responding to the expected increase in workload.” Review of the Terrorist 
Screening Center’s Efforts to Support the Secure Flight Program, U.S. Depart- 
ment of Justice Office of the Inspector General, at (ix). Further, the report con- 
cluded that “ . . . TSC is trying to plan for a program that has several major 
undefined parameters. Specifically, the TSC does not know when Secure Flight 
will start, the volume of inquiries expected and the resulting number of re- 
sources required to respond, the quality of data it will have to analyze and the 
specific details of the phased-in approach for taking the program from ‘pre-oper- 
ational testing’ in September 2005 to full operational capability in FY 2007.” Id. 
at (ix). 

On December 7, 2005, a panel of independent experts advising DHS found that 
“ . . . the program is not yet fully defined ...” and recommended that 
“ . . . there must be an overall system description that addresses all aspects of the 
Secure Flight system including external supporting systems, policies, applications 
and infrastructures, as well as related business processes managed by entities exter- 
nal to the Secure Flight program office.” Department of Homeland Security Data 
Privacy and Integrity Advisory Comm. Rep., Recommendation on the Secure Flight 
Program, Adopted Dec. 7, 2005, at 1, 2. 

As the ACLU stated at the outset, this program — like Registered Traveler — is a 
moving target, which leads to only one conclusion: the testing thus far has been un- 
able to demonstrate that Secure Flight can predict those flyers who are potential 
terrorists and/or identify and prevent known terrorists from fljdng. No modification 
can change the conclusion that Secure Flight simply will not work, the ACLU rec- 
ommends that Congress: 
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1) Direct the TSC only to maintain a short list of known terrorists who pose 
a specific threat to aviation security and dispense with the bloated No Fly and 
Selectee Lists. 

2) Explicitly repeal the authorization for Secure Flight or any similar program, 
and, instead, use TSA and TSC to compare names of would-be passengers to 
the pared down list of known terrorists who pose a specific threat to aviation 
security. 

3) Utilize the funds saved by eliminating Secure Flight to invest in programs 
that will greatly enhance physical screening including the introduction of appro- 
priate new technologies and the screening of all carry-on bags, luggage and 
cargo for explosives and weapons. 

4) If Congress decides to allow Secure Flight testing to continue, it should insist 
that TSA comply with the spirit and letter of the law expressed in both the FY 
2005 and FY 2006 DHS Appropriations laws. Congress should insist expressly 
that TSA not implement the program, even on a test basis impacting actual 
passengers, unless and until the GAO certifies first that all ten of the Congres- 
sionally mandated criteria have been satisfied. 

III. Registered Traveler: The Misalignment of Profit and Seeurity Trades 
the Promise of Speed for Personal Privacy and the Illusion of En- 
hanced Security 

Like Secure Flight, TSA’s proposed Registered Traveler program should be 
blocked from implementation. The Registered Traveler concept, whether entirely 
government run or partially privatized, trades the promise of speedy screening for 
the illusion of enhanced security. This concept misaligns the profit motive with the 
country’s need for safety. The ACLU does not believe that security should be traded 
for expediency. The ACLU therefore recommends that Congress eliminate TSA’s au- 
thorization to develop Registered Traveler. If Congress does proceed with Registered 
Traveler, the ACLU recommends that TSA not privatize Registered Traveler. If 
Congress does allow TSA to privatize Registered Traveler, the ACLU recommends 
that the government — not commercial companies — undertake background checks on 
program applicants, and that Congress expressly prohibit private companies from 
accessing third-party companies’ commercial data to determine applicants’ risk as- 
sessments. 

Registered Traveler also remains largely undefined, but the TSA’s public pro- 
nouncements suggest the basic parameters of the program. Frequent flyers would 
be granted some combination of alternating security screening benefits, which would 
induce them to undergo an extensive background check to pre-dear them for flying. 
Passengers would be required to provide extensive amounts of sensitive, personally 
identifiable information to qualify. The information provided is likely to include, but 
not be limited to, financial and credit information, residence history, and biometrics 
such as an iris scan or fingerprint. If the background check — either undertaken by 
the government or a private sector company — raises no red flags, the applicant 
would either (depending on the airport) be permitted to cut to the front of the secu- 
rity screening lines (as has been done in the Orlando, Florida pilot program), or 
would be ushered into a screening lane dedicated solely for Registered Traveler par- 
ticipants. 

A. Security: Registered Traveler Wrongly Assumes Background Data can Predict a 
Person’s Future Behavior 

Like Secure Flight, Registered Traveler rests on a dangerously flawed premise, 
which causes it to provide the illusion of greater security without actually making 
airlines safer. Registered Traveler will be vulnerable to “sleeper cells,” i.e., terrorists 
with no previously known or detectable ties to terror who could establish themselves 
as unremarkable members of society. To support Registered Traveler, one must ac- 
cept the untested premise that by checking a would-be flyer’s background, the gov- 
ernment (or a commercial enterprise) can identify terrorists and predict a flyer’s fu- 
ture behavior. This premise is fatally flawed. The data that will be provided for a 
background check may allow a credit card company to determine whether a person 
is a credit risk, but it cannot identify someone harboring a dangerous plan and a 
willingness and capability to undertake a terrorist attack that causes a threat to 
aviation. No one knows what criteria will allow the government to ferret out the 
innocent traveler from the sleeper cell participant waiting for instructions to carry 
out a terrorist attack. For example, the four men who bombed the London, England 
subway system on July 7, 2005 reportedly had no prior known ties to terror. Thus, 
no amount of data could have uncovered their sympathies or plans. Similarly, the 
9/11 terrorists spent many months in this country, demonstrating that A1 Qaeda is 
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patient and well funded. Congress should expect that similar cells of innocent-seem- 
ing individuals could be sent to this country to establish lives that would allow them 
to pass the Registered Traveler background checks. This would allow them to avoid 
suspicion until they later receive instructions to conduct terrorist attacks. Because 
glaring loopholes exist in the Nation’s physical screening, no amount of “layered se- 
curity” will detect these sleeper cells. 

Further, while background checks look at people’s data histories, they only pro- 
vide a review at one moment in time. Thus, they cannot predict future behavior. 
Simply because a person has not, to date, demonstrated indicia of adherence to a 
dangerous ideology does not mean that a person’s ideology will not evolve. No one 
could have predicted the rapid transformation of John Walker Lindh from college 
student to disgruntled Taliban fighter. Further, TSA must not focus solely on A1 
Qaeda. Lone, disgruntled individuals may lose their minds and some may attempt 
to commit a terrorist attack on aviation. If that person has previously been an up- 
standing member of society, there would be nothing to prevent them from participa- 
tion in Registered Traveler and its lessened security screening. 

B. Privatization of Registered Traveler is Dangerous: Registered Traveler Misaligns 

Profit Motive with Security 

Registered Traveler will make Americans less safe because it misaligns profit in- 
centives with the national security needs of this country. Corporations exist to make 
profit for their owners and shareholders. That legal reality creates an incentive to 
optimize and cut corners where possible. Thus, privatization of such a program will 
make us less safe in two different ways. 

First, to attract participants, companies will offer the fastest possible screening 
lanes, while maximizing profits. This will require hiring low-cost, low-skill laborers 
who will go through the motions of screening Registered Traveler participants for 
weapons and explosives. The government’s TSA screeners already routinely fail to 
identify such dangerous contraband during routine testing. Private screeners, over- 
seen by managers who are intent on maximizing the attractiveness of the Reg- 
istered Traveler screening lanes, will have a disincentive to go the extra mile to 
identify items that could bring down a plane or harm the crew and passengers; 
doing so slows down screening and eliminates the one advantage for participants. 
Furthermore, the same company will take applications for Registered Traveler, con- 
duct the background checks on applicants, gather the biometric data to issue pass 
cards, and then may perform screenings at the airports. This streamlined, profitable 
vision does not provide for sufficient security oversight. If a terrorist fools the one 
company the terrorist applies to, the terrorist will be given a Registered Traveler 
pass providing them with reduced physical screening at the airport every time they 
attempt to fly. 

Second, offering “advantages” to decrease screening time per flyer, such as those 
TSA has publicly promised — i.e., not forcing individuals to have their shoes, jackets 
and laptop computers screened — creates vulnerabilities. If there is a security value 
in screening for these items, then all flyers — whether they are in the regular screen- 
ing lanes or the dedicated Registered Traveler screening lanes — should be forced to 
comply. Congress should expect that A1 Qaeda or other enemies of this Nation will 
detect the weaker security protocols for Registered Travelers and will attempt to ex- 
ploit them to carry out future attacks. 

C. Civil Liberties: Reliance on Flawed Commercial Data Leads to the Wrongful 

Placement on a List of Un-Register-able Travelers with Unknown Consequences 

Registered Traveler also impermissibly threatens civil liberties. The background 
checks will rely on commercial data, which is notoriously inaccurate. Data errors are 
common in every database. Numbers and names get transposed. While there can be 
only one Senator Ted Stevens, data about people with similar names, like T. Ste- 
vens, Teddy Stevens or Theodore Stevens could be wrongly merged with the Sen- 
ators files collected by various companies. The data aggregators who are most like- 
ly to provide the commercial data, like ChoicePoint, do not audit the accuracy of 
their dossiers of information. Thus, either the government or a private company will 
assign a risk assessment to Registered Traveler applicants that could be fundamen- 
tally wrong. Current law does not give consumers the right to access, review, and 
correct errors in files maintained by commercial enterprises. 

In the fall of 2005, Congress decided this risk was unacceptable and passed a law 
expressly prohibiting TSA from using commercial data to pre-screen passengers for 
Secure Flight. Congress codified this understanding in the FY 2006 Department of 
Homeland Security Appropriations bill. During the Senate Appropriations Commit- 
tee’s mark-up of the bill. Ranking Member Robert Byrd (D-WV) said that: 
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. . . the bill contains an important protection for the privacy rights of Ameri- 
cans. We need always to keep these rights in mind. I thank Chairman Gregg 
for his support of language that I recommended concerning Secure Flight, the 
Department’s proposed new airline passenger profiling system. The lan^age 
would prohibit the use of commercial datahases for confirming the identity of 
airline passengers. Such commercial databases are unreliable and poten- 
tially invade people’s privacy. 

Transcript of Senate Appropriations Committee Mark of H.R. 2360, the FY 2006 
DHS Appropriations bill, July 7, 2006 (emphasis added). On January 20, 2006, TSA 
demonstrated that it did not get the message when it announced that the newly re- 
formulated Reristered Traveler program would have private companies screen data 
collected by other private companies concerning applicants. The ACLU, therefore, 
requests that Congress again expressly prohibit by statute TSA — or companies with 
which TSA contracts to perform Registered Traveler services — from utilizing com- 
mercial data to assess applicants for Registered Traveler. 

No one — not Congress, TSA, the companies wishing to operate Registered Trav- 
eler programs, or the ACLU — knows what it will mean for someone to be wrongly 
denied when they apply for Registered Traveler. If a third list of Un-Registerahle 
Travelers is created from those blocked from joining Registered Traveler, there may 
be other consequences such as that list being used to deny the applicant a govern- 
ment security clearance necessary for a job, or to prevent the applicant from enter- 
ing a government building. Several questions about the consequences should be con- 
sidered: 

1) Will those denied registration be put into a third list of undesirable flyers — 
the “Un-Registerable Travelers?” 

2) If so, will they be automatically selected for additional, intrusive screening 
every single time they fly? 

3) If private companies, essentially functioning as government actors, wrongly 
determine that an applicant poses a risk, what legal recourse will the flyer have 
to challenge that finding if it is used to create a third list? 

Moreover, those denied the chance to be Registered Travelers will be forever re- 
quired to pass through the “slow” screening lanes for all flyers. There, they will be 
subjected to more invasive screening than the Registered Travelers. Finally, those 
denied are likely to be disproportionately poor, minorities, and women; these groups 
simply are less likely to have the lenrthy data trail and credit standing to guar- 
antee participation. Congress will need to ensure that this program cannot create 
a de facto second-class status for would-be flyers whose commercial data is not as 
clean as that of wealthy businessmen. 

D. Privacy: Frequent Travelers Should Not be Forced to Choose Between their Sen- 

sitive, Private Information and Speed of Screening 

Registered Traveler also poses an unacceptable inducement that causes business 
and other frequent travelers to involuntarily forego their personal privacy for the 
promise of speed and efficiency in screening. This is a choice that Congress should 
not ratify. No one should be forced to choose between privacy and speed. When 
screening lanes are taken from the mass of the fl 3 dng public and dedicated for Reg- 
istered Travelers, the lines for everyone else get significantly longer. This creates 
a scarcity of time and screening lanes. Inevitably, the occasional traveler or privacy- 
sensitive traveler will be induced to undergo extensive background checks and share 
their most sensitive, personally identifiable information to migrate to the faster 
lanes. Given a truly equal choice, almost no one would voluntarily share his or her 
private information. But when the TSA turns screening into a chokepoint at air- 
ports, it forces people to override their instincts. This enforced scarcity renders the 
choice to share private information involuntary. 

E. Speed and Efficiency Benefits Negligible, Unproven and Possibly Illusory 

Ironically, the benefits of participation in Registered Traveler remain unclear and 

will likely prove illusory as the program grows and increasing numbers of people 
are registered for the “fast lane.” To date, the TSA has not published any studies 
demonstrating that either dedicating screening lanes for Registered Traveler partici- 
pants, or allowing Registered Traveler participants to jump to the front of the line, 
will not make the lines for the mass of the fl 3 dng public longer. A small percentage 
of frequent flyers constitute a disproportionate percentage of the individual screen- 
ing interactions. Therefore, simply removing them from the “slow” screening lines 
will not necessarily translate into faster screening lanes for Registered Travelers. 
If we assume that the vast majority of all the targeted frequent flyers participate, 
then the dedicated lines for Registered Travelers will be lengthy at peak flying 
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times. During off-peak hours, the lines are not likely to he long in either the normal 
screening lanes or the Registered Traveler lanes. Similarly, some airports do not ex- 
perience the lengthy lines that would push people to apply for Registered Traveler. 
Finally, TSA promises to occasionally modify the screening protocols for Registered 
Travelers to avoid predictability by terrorists. This will erode or eliminate any of 
the already negligible speed and efficiency gains and it does little for frequent flyers 
eager to fly during peak hours. The ACLU, therefore, wonders how TSA can guar- 
antee Registered Traveler participants any benefits at all. 

The ACLU recommends that Congress expressly eliminate the authorization for 
Registered Traveler and ensure that all flyers be treated efficiently during screen- 
ing. The ACLU further recommends that Congress utilize the funds saved to rede- 
sign some airports to permit for more screening lanes to be used by all flyers, pur- 
chase more screening equipment and hire more TSA screeners. 

rV. Conclusion: Secure Flight and Registered Traveler are Not Ready for 
Take Off and Congress Must Take Action 

The ACLU has shown that Secure Flight and Registered Traveler pose unaccept- 
able risks to security, civil liberties and privacy. For too long, TSA has wasted 
money attempting to launch programs predicated on a flawed assumption that a fly- 
er’s behavior can be predicted by reviewing information collected about their past. 
Since TSA cannot demonstrate the benefits of these programs Congress should: 

• Expressly eliminate the statutory authorization for TSA to test and implement 
these programs, irrespective of the programs’ names. 

• Request that the TSC scrap the bloated No Fly and Selectee Lists and instead 
maintain a pared down list of known terrorists who pose a specific threat to 
aviation security. TSA and TSC should then be directed to compare passenger 
manifest lists to the names of those terrorists who buy tickets and attempt to 
fly under their own names. 

• If Congress permits Registered Traveler to proceed, Congress should insist that 
it be solely government run and operated. 

• If Congress insists that Registered Traveler be partially privatized, it should 
prohibit expressly Registered Traveler companies, or any companies performing 
background checks, from utilizing commercial data about applicants obtained 
from other companies. 

ENDNOTES 

1 During Fiscal Years 2002 through 2006, Congress has appropriated a total of 
$162.3 million for the combined CAPPS II and Secure Flight program, and $30 mil- 
lion for Registered Traveler. The Presidents’ FY 2007 budget requests an additional 
$40 million for Secure Flight. 

2 The ACLU does not oppose the Federal Government’s keeping and maintenance 
of a list of terrorists known to pose a threat to aviation security. Keeping such a 
list, limited only to known terrorists, focuses the Nation’s anti-terror efforts to pre- 
vent against another attack on a passenger airline. Coupling a refocused list with 
(1) improved physical screening of all carry-on bags, luggage and cargo; and (2) the 
introduction of new technologies that are narrowly tailored to search for threats 
such as plastic explosives which cannot be detected by current metal detectors, will 
substantially improve the safety of domestic commercial air flights, while elimi- 
nating infringements on civil liberties and privacy. Where, in the rare instance, peo- 
ple attempting to fly have names similar to such known threats to aviation security, 
TSA and TSC could request the submission of the bare minimum of additional per- 
sonally identifiable information — such as three part name and date of birth — that 
will distinguish innocent travelers from terrorists. TSA and TSC also should be 
forced to provide a means for permanently removing these innocent people from sus- 
picion, perhaps through the government’s provision of a unique identifier. 

^See, H.R. Conf. Rep. No. 109-241, at 54 (2005). (“The provision also prohibits 
the use of commercial data.”); and Pub. L. No. 109-90 §5 18(e), (“None of the funds 
provided in this or previous appropriations Acts may be utilized for data or a data- 
base that is obtained from or remains under the control of a non-Federal entity: Pro- 
vided, That this restriction shall not apply to Passenger Name Record data obtained 
from air carriers.”). 

“^The ACLU fears that unless Congress acts, the principle of information sharing 
will lead to the migration of the No Fly and Selectee Lists to other government 
agencies, which may use the lists to wrongly deny innocent individuals access to 
government buildings. It would be unacceptable for these Lists, which should be 
used only to find and stop those who threaten aviation, to be used to prevent inno- 
cent people from accessing government buildings. Members do not want veterans 
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wrongly denied access to Veterans Affairs offices or senior citizens wrongly denied 
access to Social Security Administration buildings. Furthermore, circulation of these 
lists — once pared down to one list consisting solely of those known threats to avia- 
tion security — make it far more likely that terrorists will know the government is 
looking for them by name. Thus, national security concerns suggest that the revised 
List be kept close and used only for passenger pre-screening. Therefore, the ACLU 
recommends that Congress should explicitly mandate that the No Fly and Selectee 
lists not metastasize and migrate to be used by other Federal, State and local gov- 
ernments. 

® Section 522 provides in pertinent part: 

(a) None of the funds provided by this or previous appropriations Acts may be ob- 
ligated for deployment or implementation, on other than a test basis, of the Com- 
puter Assisted Passenger Prescreening System (CAPPS II) or Secure Flight or other 
follow on/successor programs, that the Transportation Security Administration 
(TSA), or any other Department of Homeland Security component, plans to utilize 
to screen aviation passengers, until the Government Accountability Office has re- 
ported to the Committees on Appropriations of the Senate and the House of Rep- 
resentatives that — 

(1) a system of due process exists whereby aviation passengers determined to 
pose a threat are either delayed or prohibited from boarding their scheduled 
flights by the TSA may appeal such decision and correct erroneous information 
contained in CAPPS II or Secure Flight or other follow on/successor programs; 

(2) the underl 3 dng error rate of the government and private data bases that will 
be used both to establish identity and assign a risk level to a passenger will 
not produce a large number of false positives that will result in a significant 
number of passengers being treated mistakenly or security resources being di- 
verted; 

(3) the TSA has stress-tested and demonstrated the efficacy and accuracy of all 
search tools in CAPPS II or Secure Flight or other follow on/successor programs 
and has demonstrated that CAPPS II or Secure Flight or other follow on/suc- 
cessor programs can make an accurate predictive assessment of those pas- 
sengers who may constitute a threat to aviation; 

(4) the Secretary of Homeland Security has established an internal oversight 
board to monitor the manner in which CAPPS II or Secure Flight or other fol- 
low on/successor programs are being developed and prepared; 

(5) the TSA has built in sufficient operational safeguards to reduce the opportu- 
nities for abuse; 

(6) substantial security measures are in place to protect CAPPS II or Secure 
Flight or other follow on/successor programs from unauthorized access by hack- 
ers or other intruders; 

(7) the TSA has adopted policies establishing effective oversight of the use and 
operation of the system; 

(8) there are no specific privacy concerns with the technological architecture of 
the system; 

(9) the TSA has, pursuant to the requirements of section 44903(i)(2)(A) of title 
49, United States Code, modified CAPPS II or Secure Flight or other follow on/ 
successor programs with respect to intrastate transportation to accommodate 
States with unique air transportation needs and passengers who might other- 
wise regularly trigger primary selectee status; and 

(10) appropriate life-cycle cost estimates, and expenditure and program plans 
exist. 

(d) None of the funds provided in this or any previous appropriations Act may be 
utilized to test an identity verification system that utilizes at least one database 
that is obtained from or remains under the control of a non-Federal entity until TSA 
has developed measures to determine the impact of such verification on aviation se- 
curity and the Government Accountability Office has reported on its evaluation of 
the measures. 

(e) TSA shall cooperate fully with the Government Accountability Office, and pro- 
vide timely responses to the Government Accountability Office requests for docu- 
mentation and information. 

(f) The Government Accountability Office shall submit the report required under 
paragraph (a) of this section no later than March 28, 2005. 

® Section 518 provides in pertinent part: 

(a) None of the funds provided by this or previous appropriations Acts may be ob- 
ligated for deplo 3 mient or implementation, on other than a test basis, of the Secure 
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Flight program or any other follow on or successor passenger prescreening pro- 
grams, until the Secretary of Homeland Security certifies, and the Government Ac- 
countability Office reports, to the Committees on Appropriations of the Senate and 
the House of Representatives, that all ten of the elements contained in paragraphs 
(1) through (10) of section 522(a) of Public Law 108-334 (118 Stat. 1319) have been 
successfully met. 

(b) The report required by subsection (a) shall be submitted within 90 days after 
the certification required by such subsection is provided, and periodically thereafter, 
if necessary, until the Government Accountability Office confirms that all ten ele- 
ments have been successfully met. 

■^This is a similar issue to that, discussed above, that reportedly plagued U.S. 
Senator Ted Kennedy. 

The Chairman. Thank you very much. 

Our next witness is Bill Connors, the Executive Director and 
Chief Executive Officer of the National Business Travel Associa- 
tion. 

Mr. Connors? 

STATEMENT OF BILL CONNORS, EXECUTIVE DIRECTOR AND 

CHIEF OPERATING OFFICER, NATIONAL BUSINESS TRAVEL 

ASSOCIATION 

Mr. Connors. Mr. Chairman, pleasure to be here — Senator 
Inouye — thank you for inviting us. 

Distinguished Committee Members, the National Business Trav- 
el Association’s honored to be here today to participate in this dis- 
cussion regarding the Registered Traveler Program and Secure 
Flight. 

NBTA is the world’s largest association of corporate travel buy- 
ers, corporate meeting planners, and travel purchasing profes- 
sionals. A majority of the Fortune 500 companies in this country 
have travel managers within our organization. Our members direct 
millions and millions of business travelers each day. So, we’re 
pleased to be here representing the interests of America’s corpora- 
tions, their travelers, and their ability to conduct commerce around 
the globe. 

NBTA has been particularly focused on the issues of travel secu- 
rity and travel facilitation since 9/11. We’re especially interested in 
the Registered Traveler Program, and look forward to its expan- 
sion. As a participant, myself, in the Registered Traveler pilot pro- 
gram here at Reagan Airport, I think the program offers business 
travelers two important improvements: productivity and predict- 
ability. 

In recent NBTA surveys, we found that 92 percent of frequent 
business travelers have a desire to join an RT program, so there’s 
clearly a demand for this concept. 

NBTA has been encouraged by the recent vision set forth by Sec- 
retaries Rice and Chertoff regarding issues of security and travel 
facilitation. We’ve been further encouraged by a growing theme 
from our friends at DHS and TSA suggesting resources should be 
focused on the most serious potential risks to our Nation. The Reg- 
istered Traveler Program is a good example of how smart risk man- 
agement can both enhance the airport experience and allow for 
greater focus on finding potential bad guys. The RT Program will 
allow TSA to search a smaller haystack while moving people more 
efficiently through our airports. 



72 


NBTA has been a strong supporter of the RT Program, provided 
four basic requirements are met in any public or private adminis- 
tration of the program. Those four are, number one, that the pro- 
gram is strictly voluntary; number two, that the privacy of the par- 
ticipants is protected; number three, the program actually saves 
time for participants, while not slowing down nonparticipants; 
number four, the program is interoperable, secure, and overseen 
broadly by Federal authority. 

We’ve heard a lot today about the Registered Traveler program, 
and while I’m aware there’s great interest in this program, I am 
also aware that it’s been very slow to materialize. Mr. Chairman, 
we could use your leadership on this particular issue. We would be 
happy to see you establish some specific program deadlines, and 
perhaps even recall this Committee three months from now to talk 
about progress on the Registered Traveler Program. 

It is our hope that the RT program will be up and running in 
2006 at scores of airports across this country, helping thousands of 
business travelers get back on the road to do the business of Amer- 
ica. 

Though we’re largely here to talk about Registered Traveler, I 
would like to say a couple of things about Secure Flight. In regards 
to the Secure Flight program, we agree with many others here that 
airport screening procedures should use passenger data that is 
clean, clear, consolidated, and current. Pinging passenger names off 
multiple lists from multiple agencies yields multiple results. 

The Secure Flight program must comply with the ten operational 
standards laid out by Congress and reported in the GAO report of 
March 2005. And we want to emphasize one of those standards in 
particular, which several others have emphasized here, as well. 
There must be a simple, secure passenger-redress system for re- 
moval from No-Fly lists. This must become a priority immediately 
in moving forward in any future program. 

Finally, any changes in data-collection policies must consider 
costs to the corporations, the agencies, and the airlines who are 
asked to collect that data. That last point implies that involving 
private-sector in all of these discussions about passenger screening 
would help facilitate the program. In that regard, we again ap- 
plaud the shared vision statement from Secretaries Chertoff and 
Rice calling for a private-sector advisory board to offer input on 
programs like the very two that we’re talking about today. 

The National Business Travel Association stands ready to sup- 
port and serve with DHS and State in standing up such a body. 

Thank you very much for the opportunity to be here. 

[The prepared statement of Mr. Connors follows:] 

Prepared Statement of Bill Connors, Executive Director and Chief 
Operating Officer, National Business Travel Association 

Thank you Mr. Chairman, Senator Inouye and Members of the Committee. I am 
Bill Connors, Executive Director and COO of the National Business Travel Associa- 
tion (NBTA). On hehalf of our members, I appreciate the opportunity to participate 
in today’s hearing regarding TSA’s passenger prescreening programs — specifically 
Secure Flight and Registered Traveler. 

The National Business Travel Association is the authoritative voice of the busi- 
ness travel community, representing more than 2,700 corporate travel managers 
and travel service providers who collectively manage and direct more than $170 bil- 
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lion of expenditures, primarily for Fortune 1000 companies. Our members represent 
a broad cross-section of corporate America including millions of business travelers. 

I want to first express the collective appreciation of the business travel commu- 
nity for your commitment to addressing the important issues of the Registered Trav- 
eler and Secure Flight programs and for including the perspective of the frequent 
business traveler in today’s hearing. Our members share a common bond with many 
of the Members of this Committee in that travel is an occupational necessity. 

Each day, thousands of business travelers arrive at airports across the Nation, 
ready to traverse the security checkpoints. Theirs is a perspective which differs sig- 
nificantly from other stakeholders in this process. Our Nation’s most frequent trav- 
elers have a unique view of the effectiveness and the deficiencies of our current se- 
curity regime, and it is vitally important that this perspective be considered in the 
debate over new security programs. 

Business travelers over the past four years have experienced significant con- 
straints given the cascading security requirements set forth by the Congress and im- 
plemented by the Department of Homeland Security. Business travelers are among 
the most experienced visitors at our airports and certainly understand and appre- 
ciate the necessity for these security measures to ensure national security and the 
continued viability of commercial aviation. 

NBTA supports the goals of the prescreening and physical screening regimes put 
in place in response to the 9/11 attacks. In the aftermath of the terrorist attacks, 
business travelers were among the first passengers in the sky, and are again trav- 
eling in record numbers, as aviation levels return and even surpassing record levels. 
Over the past four years, one universal theme has been iterated by the vast major- 
ity of these travelers — we can and must establish more efficient and effective secu- 
rity measures by soliciting the cooperation of frequent travelers and utilizing avail- 
able technologies to accomplish a less onerous and more effective level of safety and 
security. 

Registered Traveler 

The announcement by the Transportation Security Administration (TSA) regard- 
ing the national Registered Traveler plan was a welcome development for business 
travelers. RT pilot programs, such as the one undertaken at the Orlando Inter- 
national Airport, demonstrate that frequent travelers will embrace an opt-in system 
which provides a level of expediency and predictability to the screening process. 

The RT initiative is a concept endorsed by the 9/11 Commission and Members of 
Congress as a way to enable security personnel to dedicate resources to more tar- 
geted risks. This concept is rooted in the belief that strong, effective travel security 
lessens unnecessary burdens on travelers. Registered Traveler is a demonstrable ex- 
ample that utilization of current technologies has the potential to provide the more 
than six million frequent business travelers with a more rapid, yet still secure 
screening process. 

Affording passengers the opportunity to opt-in to the RT program provides a 
measure of predictability and reliability that corporate America has long sought. As 
companies seek to squeeze greater productivity gains out of their workforce, the 
ability of traveling employees to navigate through a web of security checkpoints in 
an efficient and reliable manner is critical in reducing time spent in the airport and 
increasing time spent conducting business. 

Wait times at security checkpoints are anything but constant and current proto- 
cols dictate that passengers must arrive even earlier to ensure they are processed 
through security. Further, passengers traveling to different airports throughout the 
country have no ability to gauge wait times at each respective airport. While TSA 
has made measurable progress over the past year in addressing this issue, RT pro- 
vides the promise that frequent business travelers will realize an increased level of 
measurability with respect to checkpoint wait times. 

Much of the anecdotal evidence received from NBTA members participating in the 
Orlando International Airport pilot project indicates that RT participants indeed re- 
alized significantly reduced wait times. This was true even though the Orlando par- 
ticipants received the same security scrutiny (such as removal of shoes and coats) 
as did non-Registered Traveler participants. However, participants did benefit from 
access to a segregated security screening line. We fully expect that business trav- 
elers will derive even greater benefits when the full program is implemented and 
a complete slate of additional benefits is available to participants. 

The success of the Orlando pilot project holds much promise for the potential of 
a national RT program, yet to ensure the fundamental success of the program, TSA 
must continue to address certain fundamental issues. TSA must continue to provide 
assurances that privacy concerns will be addressed in the implementation of the na- 
tional Registered Traveler program. In a joint survey conducted by NBTA and the 
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Travel Industry of America, 92 percent of business travelers indicated a desire to 
participate in this program, and we expect that number to increase as the process 
becomes more transparent and TSA continues to offer assurances that passenger in- 
formation privacy will be a primary tenet of the RT program. TSA’s Registered 
Traveler archetype of a market-driven, private sector model must have informa- 
tional safeguards governing the provision of personal information to third parties. 

TSA has indicated that a core security assessment will be a requirement for each 
applicant seeking participation in the RT program, but more in-depth background 
checks using commercially available data may be undertaken by the private pro- 
gram providers. The trade-off for increased security scrutiny, as iterated by TSA, 
will be “a variety of enhanced or time-saving participant benefits at passenger 
screening checkpoints.” As an opt-in system, RT applicants will have the final say 
in the information they seek to provide above and beyond the required TSA baseline 
information. Additionally, these enhanced security benefits could be derived through 
the deployment of additional security technology at RT checkpoints, such as Trace 
Detection equipment. 

NBTA has joined many other stakeholders in this process in calling for a system 
of mandatory interoperability. Enrollees must be able to reap the benefits of partici- 
pation at all airports engaging in the RT program. Corporate travel managers must 
be assured that private companies offering Registered Traveler cards will indeed 
work to develop a network where participants have universal access to RT privi- 
leges, regardless of the company providing the card. Additionally, interoperability 
will increase competition among companies offering RT cards, and as a consequence 
consumers will likely receive increased benefits at competitive costs. Stakeholder 
groups under the umbrella of the Voluntary Credentialing Industry Coalition 
(VCIC) have already initiated efforts to establish interoperability standards. These 
efforts signal a willingness on the part of industry to cooperatively engage with TSA 
in crafting a system that is viable and attractive to the business community. 

Registered Traveler is a unique concept in the current security environment be- 
cause it constitutes the first program dedicated exclusively to both traveler facilita- 
tion and focusing limited security resources in a threat based model. Significant 
progress has been made in outlining the RT program, and it will take the coopera- 
tive involvement of the aviation industry, government officials and travelers to en- 
sure the system can continue to provide visceral benefits to participants. 

Secure Flight 

NBTA supports the steps taken by Congress to ensure the viability of Secure 
Flight before it becomes operational. As we all know, the current system draws too 
many people into secondary screening. Many frequent travelers have witnessed 
grandparents, children, and even Members of Congress unnecessarily selected for 
secondary screening. Not only is this process frustrating to the traveler, but it draws 
important resources away from the screening process. The process reflects the need 
to move forward in crafting a more pensive, comprehensive, threat-based model of 
security screening. 

As TSA moves closer to launching Secure Flight, we urge careful consideration of 
several critical issues outlined in the March 2005 General Accountability Office 
(GAO) report to Congress. GAO described the progress that TSA has made in ad- 
dressing the ten critical elements outlined by Congress, but GAO also appropriately 
recognized that additional progress is necessary leading up to the implementation 
of Secure Flight. Specifically issues of passenger redress as well as privacy concerns 
must be fully addressed in advance of the roll-out of this program. 

It is difficult to discuss Secure Flight or passenger pre-screening issues without 
addressing the issue of passenger redress. Numerous business travelers have been 
ensnared on TSA’s No Fly List or Selectee List, with little knowledge of how to navi- 
gate through the recourse process. These travelers then find out that they must 
complete the Passenger Identity Verification Form, mail the form to TSA, and wait 
for a finding. This antiquated system is time consuming and inefficient. 

While the high profile cases of mistaken identity might provide amusing head- 
lines, the hundreds of cases of mistaken identity involving less famous business 
travelers are just as serious. A recent survey conducted by NBTA found that over 
one-fourth of our member companies have over 5,000 business travelers per year. 
The frequency of business travel offers many chances for a case of mistaken identity 
and the disruptions that come with it. Many of our member companies struggle 
daily with watch lists issues that eventually are resolved, but the length of the proc- 
ess and the interim time spent waiting for resolution is costly to American busi- 
nesses. An expedited process utilizing current technologies is not only possible, it’s 
necessary. 
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Recently, Homeland Security Secretary Chertoff and Secretary of State Rice an- 
nounced the Secure Borders and Open Doors initiative which included a proposal 
for “one stop” redress for travelers ensnared on the watch lists. This initiative prom- 
ises a government-wide traveler screening redress process to resolve questions if 
travelers are incorrectly selected for prescreening. This is an extremely positive de- 
velopment, and NBTA fully supports the effort undertaken by both the Department 
of State and Department of Homeland Security to develop a system that utilizes 
current technologies to expedite passenger redress. As this system is being devel- 
oped, TSA has indicated that it will continue to utilize its current Office of Redress 
to handle any watch list issues. 

One of the fundamental problems of the current system is that most business 
travelers and their corporate travel managers are not aware of the procedures for 
redress. Even those travelers who are aware of their redress options find the cur- 
rent system exceedingly difficult to maneuver through. Many passengers have re- 
ported continued problems with repeated additional screening even after they have 
undergone all redress procedures and have been cleared by TSA. We urge that 
throughout the life of the current system and in advance of the implementation of 
the new passenger redress system, TSA undertake efforts to educate the traveling 
population on the steps passengers can take to resolve the questions of selection for 
additional screening. 

While the problems with passenger redress may appear to be an individual prob- 
lem, it has a definitive and collective impact on corporate travel planning. Similarly, 
seemingly insignificant changes to informational requirements have had significant 
financial impacts on several corporations. Secure Flight will require passengers to 
provide additional personal information in advance of travel. While this may seem 
innocuous to individuals required to provide the information, it poses some concerns 
for corporate travel. 

Seventy percent of corporate travel managers currently utilize corporate online 
booking tools to capture the information necessary to book travel for their corporate 
travelers. That number is expected to grow to 90 percent or more within two years. 
And while there is no institutional resistance to making these appropriate changes 
to accommodate passenger prescreening, changes in the fields of information re- 
quired by TSA would impose a significant cost on companies and businesses uti- 
lizing online booking tools, as they would have to revamp the software to capture 
and send newly required data. 

Additionally, it is possible that information required hy Secure Flight could force 
companies to undertake the cost of revamping internal privacy polices, as many 
companies currently prohibit providing employee personal information, such as so- 
cial security numbers and date of birth, to third parties. NBTA encourages TSA to 
work closely with the private sector to ensure that Secure Flight can work with cur- 
rent and future systems used for booking travel. Corporate travel managers have 
made several changes to travel booking software over the last four years, and will 
continue to work to ensure corporate compliance with new security regulations. Yet, 
Federal officials must understand that small changes in informational requirements 
impose significant costs on corporate travel. From proposed CDC avian flu regula- 
tions seeking additional passenger information to Secure Flight informational re- 
quirements, costs on business could be significantly reduced if Federal agencies 
would work in concert to determine what type and format of information will be re- 
quired and impose those requirements at one time. 

The Secure Borders and Open Doors program may provide a framework for meet- 
ing that goal. Among the initiatives outlined in the Department of Homeland Secu- 
rity and the Department of State announcement, was developing an advisory board 
that would help determine best practices related to travel policies. NBTA supports 
this concept as we believe that this forum provides an opportunity to present unique 
private sector views to Federal officials in advance of significant rulemaking proc- 
esses. 

Ultimately Secure Flight will allow the U.S. government to focus more on the real 
threats and less on the millions of frequent travelers who are going about the Na- 
tion’s business. However, there is a need for a clear and stable regulatory frame- 
work to guarantee free movement of personal and corporate data while maintaining 
privacy, confidentiality and security. More importantly, this framework will help to 
ensure consumer and corporate confidence in the exchange of information through 
the security screening process. 

Mr. Chairman, I appreciate the opportunity to testify today, and thank you and 
the Committee for your leadership in recognizing the critical impact of these issues 
on business travel. 


The Chairman. Thank you very much for that comment. 
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Well, Mr. May, I’m back where I started before. This is not the 
subject of this hearing, but the baggage still bothers me. And I 
know that you’ve got layers of security measures that you have to 
deal with. And the question I asked the other day was. Why isn’t 
that little box that the bag has to fit in to go under the seat right 
there beside the screeners? I was told by people, when I objected 
to someone walking in front of me that had two suitcases larger 
than mine, and on the top of the little handle was a briefcase larg- 
er than my suitcase, and it had, obviously, a lot of computer stuff 
in it. Neither one of them would fit, hardly, in the overhead, let 
alone under the seat. 

Now, doesn’t the whole problem of these programs we’re dis- 
cussing here — aren’t they affected by the time with which it takes 
to take all that baggage onboard an airplane? 

Mr. May. Mr. Chairman, the good news is that I’ve had a series 
of conversations with some of our most senior executives since you 
and I spoke, night before last, on this subject. And, of course, it 
was a repeat of a conversation we had at another hearing in this 
room, a month or so ago. And I think the good news is that we 
share many of your concerns. The carriers are distinctly worried 
that people bringing on more bags than are allowed, bringing over- 
sized bags, heavier bags, et cetera, is slowing down the process, it’s 
having a real impact on productivity. And so. I’m here to tell you 
today that we are committed to pull the industry together to see 
if we can’t come up with some very real solutions. 

As you’ve identified, there was a time when those size-wise so- 
called requirements were put on the TSA screening equipment, so 
that if it didn’t fit through that, size-wise, you had to go check it 
before you even went through security. And I think that and a 
number of other ideas need to be explored as to how we go forward. 
And I’ll commit to you today that we’re going to engage the indus- 
try in this right away. 

The Chairman. Well, thank you for that. 

Do you believe that this extra layer now in Secure Flight is nec- 
essary for security? 

Mr. May. Senator, I think — quite frankly, I shudder to think of 
the hundreds of millions of dollars that have been spent on the big- 
ger subject of passenger prescreening. And it’s, quite frankly, been 
wasted money, because we don’t have a program today. I think we 
absolutely have to have a program that is simple, straightforward, 
that matches passenger identification against appropriate watch 
lists, No-Fly lists, et cetera. There probably is not a bigger priority 
for us, and we’re the ones, ultimately, that are paying for this. We 
care more about moving people through the process faster and effi- 
ciently than probably anybody else in the business. And so, I think 
that’s where the focus needs to be. I don’t think the focus needs to 
be, quite frankly, as popular as it may be, on Registered Traveler. 

Mr. Hawley, my good friend, used the word “market-based,” and 
I sort of cringe a little bit every time I hear that word, “market- 
based,” when it applies to aviation, because it generally is trans- 
lated into “airlines pay.” And I know that TSA — I looked at their 
budget the other day — plans on making about $30 million, in this 
next cycle, on RT. I know that my good friend, Mr. Barclay, has 
a congressionally mandated monopoly on being the entity that 
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checks all this. That was put in the appropriations bill last year. 
I know that a number of other people are planning to make a profit 
off of Registered Traveler. And I don’t — I’m a great free-enterprise 
person — think that’s all wonderful, but what I don’t want to see 
is the airlines ending up paying for yet another failed program that 
doesn’t work for everybody. And I’d like to see, instead, the focus 
placed on reducing those seven Government programs down to one, 
those 34 or more data requirements that we’re being hit with, here 
and in countries all over the world, simplified to a simple template 
so that we have security that works here, security that works in 
London or wherever the case might be. And that’s where the focus 
of this Committee ought to be. 

The Chairman. I think we should take 5 minutes on each wit- 
ness in this panel. 

Senator Inouye? 

Senator Inouye. Needless to say, Alaska and Hawaii have 
unique problems. Interstate travel/intrastate travel require air 
travel. In fact, in our case, it’s about 95 percent of the travel for 
the people of my state. And so, this is very important to me. 

What sort of coordination do you have with TSA? Do they confer 
with you, or do you regularly meet? 

Mr. May. Senator 

Senator Inouye. I gather, from these discussions, that we have 
separate entities trying to undo each other. 

Mr. May. Right. I think the fair answer to that question is that, 
historically, the door at TSA has always been open, the ears 
haven’t necessarily followed. So, now we have an administrator 
that I think is doing a bang-up job. Very difficult circumstances. 
It’s probably one of the tougher jobs in town. And I think Kip 
Hawley is really making some progress. 

I’m pleased with the fact they’re finally listening to complaints 
that we first registered with them back in 2002 and 2003 as to the 
multiplicity of these different passenger prescreening programs, the 
complaints that they’ve gotten on watch lists. But, as some of the 
other witnesses have said, they’ve got a mountain of problems in 
front of them trying to get all these programs worked out, getting 
a redress system put in place that’s really effective, making sure 
you’ve got a watch list that’s accurate, and a No-Fly list that’s ac- 
curate. It’s not an easy job. And I think we, and you, need to help 
them focus on that and on expediting everybody through the check- 
points with better technology, putting part-time workers on during 
peak times, finding ways to expedite pilots and crews, who are al- 
ready certified, et cetera, so that we can really put the focus on 
where it’s needed. 

They’re doing a better job. I think this TSA is the best I’ve seen 
in the time I’ve been in this industry. But they still have a ways 
to go. 

Senator Inouye. This question should have been asked of Mr. 
Hawley, but, as a matter of instinct now. I’m at the airport 2 hours 
ahead. And I do travel much, and over long distances. And I go 
through the metal detector, like all of you. I find that, over half the 
time. I’m given the special treatment, zip-zap all over the place. 
And here I am taking off my wristwatch, shoes, everything else, 
and coins. Do they adjust the metal detector? 
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Mr. May. Senator, it — ^you’ve asked me for my impression, and 
I think the answer to that is, yes, they do make some adjustments. 
Sometimes it seems that, when I go through — and maybe I’ve for- 
gotten something that’s in my pocket, and it doesn’t set it off; other 
times, when I think I’ve really cleaned myself out, I set it off. So, 
I’m not sure but what there isn’t a different adjustment available 
to them along the way. 

I will tell you this. And it’s sort of off the subject. This Com- 
mittee passed legislation telling TSA that we wanted to ban light- 
ers in baggage. We talked about the scissors, a little bit earlier. I’m 
advised that fully two-thirds of the bags that go to secondary 
search, that slow up the process for everybody, are as a result of 
those lighters. And I would suggest that, if this Committee does 
anything, it give very careful consideration to get rid of that ban, 
along with the scissors and some of the other things, because I 
think it will expedite the process for everybody immeasurably. And 
I’m not convinced that having a BIC lighter in your briefcase is a 
significant security threat. 

Senator Inouye. Do you pass on all of the costs incurred through 
Government activity to the passengers? 

Mr. May. No, sir. I wish we could. We don’t have the pricing 
power that we would like to have. And that’s why that $4 to $5 
billion a year that we’re paying to DHS and TSA hits us so hard. 
I mean, I look at an agency that has remained relatively flat in 
their budgeting since their inception — it’s about 4.5, 4.6 billion — 
and I see our fees have gone from that billion-250/260 range up to 
4 billion without, by the way, any additional congressional or Ad- 
ministration mandates. That’s just the growth of — based on the fact 
it’s a ticket tax, and we’ve got more fees going in, with the minor — 
there have been administrative increases in the Customs fee and 
the Agriculture fee, for example. So, it’s mission creep — in this 
case, it’s tax creep — that hits us. 

Senator Inouye. Senator Nelson asked a very interesting ques- 
tion, that, at several airports, you have two lines, first class 
and 

Mr. May. Right. 

Senator Inouye. — economy. Do you have any good rationale or 
justification for that? 

Mr. May. I think — I think the 

Senator Inouye. I can see where, first class 

Mr. May. Sure. 

Senator Inouye. — you could have a bigger seat and all of that. 
But on the security? 

Mr. May. Senator, there are expedited lines available in a num- 
ber of different — principally hub airports — all over the country, 
where individual carriers permit their frequent flyers and first- 
class passengers, to move up in what generally is a partially sepa- 
rated line, because it then gets merged, because everybody goes 
through the same level of security, no matter what. They don’t 
have special security treatment. And to the extent that frequent 
flyers and others have a benefit, I think that’s perfectly appro- 
priate. 

What I think ought to happen, though, is, once those two lines 
merge, that we have an overall security process that is even faster 
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and better than the one we have today. And that’s where I’d like 
to see us focus. Rather than reducing some of those security re- 
quirements to benefit a very few people, let’s have it available for 
everybody. 

Senator Inouye. None of us here are technicians. It would help 
very much if all of you can get together and tell us how this con- 
solidation of programs can be carried out. 

Mr. May. We have a series of suggestions in my written testi- 
mony, Senator — I encourage you and your staff to look at those — 
as to how we can bring some of these programs together. 

Senator Inouye. I’m very concerned about identity theft and pri- 
vacy and all those matters, as you know. 

Thank you very much, Mr. Chairman. 

The Chairman. Senator Burns? 

Senator Burns. I have, after listening to all the testimony and 
then reading everything that’s in the paper — and, by the way. Sen- 
ator Inouye, I could be riding first class, but I stay over there in 
the economy class, because I’m afraid somebody will hit me in the 
head with a bag when I go walking down through there. I don’t 
want to cause a scene or anything. 

Senator Inouye. A man of the people. 

Senator Burns. That’s right, a man of the people is exactly right. 

I just have one question. Do you still support the Registered 
Traveler and the Secure Flight programs? Are you still supportive 
of those programs, even though we’re struggling to get them in 
place in a proper way? 

Mr. May. Senator Burns, from the ATA perspective, we abso- 
lutely support the concept of Secure Flight, or whatever name you 
want to give to passenger prescreening. It’s the concept that we 
support. We don’t support, at this time. Registered Traveler. We 
think it takes the focus away from where we really ought to have 
it. 

Senator Burns. Mr. Barclay? 

Mr. Barclay. Senator, airports strongly support both programs. 

Senator Burns. Mr. Sparapani? 

Mr. Sparapani. That’s excellent, sir, actually. Thank you. Sen- 
ator. 

As I said in my statement, we think that both programs ought 
to be scrapped, and, instead, what Congress should do is insist that 
we retain this idea of focusing on a watch list that’s vastly pared 
down to really known threats to aviation security. That’s where we 
need to put our energies into. Those are the people we need to stop. 
And I don’t think that’s inconsistent with what Mr. May just said 
to you. In fact, I think if you just whittled that list down, and then 
prescreen against that smaller list, you’ll have far fewer of your 
constituents who are stopped or put on these lists and can’t get off 
of them. So, there’s some consistency here on that part. 

Senator Burns. How do we find these bad people? 

Mr. Sparapani. We’re going to have to do some work. And our 
Government’s going to have to spend some time doing it. I’ll leave 
that to the intelligence experts. But I will point out, for these two 
programs, they’re premised on a faulty premise, which is that — one 
that we reject, and I think most intelligence experts would reject — 
that terrorists are going to show up, buy a ticket — attempt to buy 
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a ticket, and attempt to show up under their own name or docu- 
ments. Once we know who they are, they’re not going to do that. 
That’s a pre-9/11 mentality. Identity theft is just simply too easy. 
Senator. 

Senator Burns. Mr. Connors? 

Mr. Connors. Senator Burns, we agree with our colleagues at 
ATA in supporting Secure Flight, particularly what Mr. May has 
said about having a uniform passenger information-collection pol- 
icy. 

We differ a little bit on our views of Registered Traveler. We cer- 
tainly encourage the expansion of the Registered Traveler program 
so that all citizens who are interested could go through the same 
sorts of lines that Mr. May just described for first-class passengers. 

Senator Burns. Well, I’ve looked at this thing, and they keep 
struggling over there, and I take to heart what Mr. Sparapani said. 
How long do we fiddle around with this thing before we finally get 
something that will work? 

I support the Secure Flight program. And, even with the Reg- 
istered Traveler, I’d be willing to buy a card, I think, you know. 
But, nonetheless, we’ve got to, some way or other, draw some con- 
clusions and either take what we’ve got and go with it or dive com- 
pletely out of it. It sounds like, to me, we’re making work. That’s 
what I’m saying. And we’re just throwing good money after bad. 
And money that we don’t have, by the way. 

And so, those are the questions I had. I’m opposed to increasing 
the tax, I will tell you that right now. I’ll 

Mr. May. Thank you, sir. 

Senator Burns. — go on record. Right now, you look down that 
ticket, and they’re going to have to make a bigger ticket. Not for 
a guy that’s got a bigger name, or the seat, but how many taxes 
you’re going to list on that darn thing. And so, it’s from that stand- 
point that I’m pretty up-front about these fees. 

Thank you, Mr. Chairman. 

The Chairman. Thank you. 

Senator Burns. And thank you for your testimony. I appreciate 
it. We’ve gleaned a lot of stuff from it. 

The Chairman. Thank you. 

Chip, when we look at this program, the new Registered Traveler 
program, it appears as if it was merged with an eye-scan concept 
or something, that it would give us a chance to deal with people 
who are really frequent flyers. Now, when you look at that pro- 
gram — have you looked at it from the point of view of fraud? Can 
it stand up alone? Can we depend on those cards? Do we have to 
have the eye scan to go along with them? 

Mr. Barclay. The — well, let me go back and say that the big dis- 
tinction — and I think Senator Burns’ comments about the two dif- 
ferent programs points it out — Secure Flight, it’s a much harder 
program, because it is looking for terrorists. Registered Traveler is 
about identifying people, at least at first, that we know are not 
threats to the system. That’s something that we can do. We can fig- 
ure out who are people that don’t threaten the system. We can 
avoid the problems that have been raised about identity theft and 
other problems by making sure biometrics are part of the system. 
And that can be eye scans. Some people that may be handicapped 
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and wouldn’t have the ten fingerprint can use eye scans. You can 
use the fingerprints. So, you make sure, each time that person you 
identified as not being a threat to the system goes through, you 
know that’s the person that you’ve got there, because of the match- 
ing of the biometrics. 

It’s very similar to what we’re trying to do at airports with the 
access to secure areas, putting biometrics on many of the doors to 
make sure that, once we vet a person and know they’re not a risk 
to the system, we know we’ve got that person every time they go 
through a door. 

We need to do the same thing with frequent flyers in the system, 
because, as everyone here knows, if you are someone who uses the 
system a lot, you’re putting aside a lot of extra time in case — not 
because there are often delays or long lines winding through the 
terminals, but there are, occasionally, so you put aside that extra 
hour every time you fly. The productivity loss to people and the 
economy is enormous. And we have these fairly small number of 
people who represent a great percentage of the passengers that 
want to be treated like employees at the airports are treated now. 

If I can make a point, one thing that I think a lot of people don’t 
realize is that every day in this country we let hundreds of people 
on airplanes with loaded guns because we’ve done background 
checks on them, and we trust them not to be dangers to the sys- 
tem. We could certainly let people, after doing the same kind of 
background checks on them, not take off their shoes and not take 
out their laptop, and vet them through the system more quickly so 
we can direct our security assets to the highest risks. That’s what 
Registered Traveler is really about. It’s saying, we’ve got limited 
security resources, let’s use them on the highest risks, because 
we’ve got a lot of people who volunteer information on themselves 
and pay for the program to be able to eliminate them from the risk 
pool. 

The Chairman. Well, I thank you for that. I do think there are 
a great many of those frequent-flyer people who will go to the Reg- 
istered Traveler Program. Their time is money. I mean, they are 
compensated by the hour. This system, currently, really is denying 
them the use of the valuable time, daytime, that they have to use 
in pursuing their livelihood. I think it’s a good program. 

Mr. Sparapani, I am a little disturbed about your testimony. And 
you want us to revoke the authorization for both Secure Flight and 
Registered Traveler and set up a process to deal with known ter- 
rorists. 

Mr. Sparapani. I do. That’s 

The Chairman. Have you 

Mr. Sparapani. — that’s correct. Senator. 

The Chairman. — have you got a list of known terrorists? 

Mr. Sparapani. I’m sorry? 

The Chairman. Have you got a list of known terrorists? 

Mr. Sparapani. No. But the 

The Chairman. Do you think 

Mr. Sparapani. — the government 

The Chairman. — we have a list of known terrorists? 

Mr. Sparapani. I think the Terrorist Screening Center does. And 
that’s the public statement from the FBI. 
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The Chairman. Well, I’m 

Mr. Sparapani. And 

The Chairman. — I’m not so sure. Do you support the President’s 
program right now that’s under attack, in terms of intercepting and 
tracking the people called within this country from outside of the 
country? You support that? 

Mr. Sparapani. Well, I don’t want to equate the two programs. 
Senator. 

The Chairman. Well, I’m asking you if you support it. You op- 
pose it, don’t you? 

Mr. Sparapani. I — we do oppose the unconstitutional applica- 
tion — 

The Chairman. Well, then what’s 

Mr. Sparapani. — of that program. 

The Chairman. What do you support to determine who is a ter- 
rorist? 

Mr. Sparapani. When we have good intelligence that has identi- 
fied a threat to aviation, we believe there should be a list of those 
people. This is just commonsense safety and security. That’s the 
list that I want the Government to use to screen for aviation secu- 
rity. And I think if we do that. Senator, we’re going to have vastly 
improved security without all the civil-liberties deprivations that 
might arise from a bloated list. We can’t simply have every Senator 
Kennedy — everyone who has a name like Senator Kennedy being 
stopped every time, because there’s an E. Kennedy on a list. You 
mentioned your wife’s situation 

The Chairman. Well, Kennedy was embarrassed, but I don’t 
think he was really hurt. And I don’t think any of us are hurt by 
trying to have the system check us to make sure we are safe to get 
on the plane with other people who are traveling. You seem to be- 
lieve, though, we should somehow or other dream up a list of 
known terrorists, and only they should be subject to screening. 

Mr. Sparapani. I think we need to put our focused resources onto 
those people who pose the threat. And if we do so. Senator, I really 
believe that we’re going to have vastly improved security. We want 
to — we really want to focus on those people who have the capability 
of threatening airline security, and we want to keep that list close. 
Right now, some of that list goes to the airlines every day, but not 
all of it. So, we’re not currently 

The Chairman. But — wait a minute 

Mr. Sparapani. — vetting against 

The Chairman. But that’s not your statement. You say you do 
not oppose the Federal Government keeping and maintaining a list 
of terrorists known to pose a threat to aviation security. 

Mr. Sparapani. That’s correct. 

The Chairman. If a person is known to be a terrorist that has 
other targets in mind, you would let them on the airplane, right? 

Mr. Sparapani. No. Senator, if somebody’s been violent, I would 
consider that somebody who is a threat to aviation security. 

The Chairman. Well, how do you define a person who’s a threat 
to aviation security as a terrorist, as opposed to other terrorists? 

Mr. Sparapani. Again, if somebody’s violent. Senator, and has a 
propensity, and the Government has good intelligence based on 
that, we don’t oppose having a list of those people. 
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The Chairman. Respectfully, we don’t have a list of people who 
are known to be a threat to aviation security. We are looking for 
terrorists 

Mr. Sparapani. Well, if that’s true. Senator 

The Chairman. — generically. 

Mr. Sparapani. — if that’s true. Senator, then the No-Fly list 
itself is 

The Chairman. All right. 

Mr. Sparapani. — is faulty. 

The Chairman. Well, I — you make some points in your testimony 
that appeal to some of us, in terms of trying to find some way to 
get to the point where we really have a system that works, but 
then you come down and say, “But it should only apply to people 
who are a threat to security.” I just cannot buy that. And I think 
that you destroy the value of your comments by telling us we 
should have a list of terrorists who are a threat to aviation secu- 
rity. I assume we’d have a list of terrorists that pose a threat to 
Federal buildings. This is getting down to the point where I just 
don’t think we can find a way to predict terrorist acts. 

Mr. Sparapani. And, Senator, we have an extra additional rec- 
ommendation, which I think would resolve the concern that you’re 
raising. We suggest that the money saved should be spent on those 
high-quality, narrowly tailored screening technologies, like this 
new puffer machine; if done right, that will prevent weapons and 
explosives from getting on planes. And if you do those two things, 
I think you’re really going to demonstrably improve airline pas- 
senger safety and security. And I think that’s what we all want. 

Senator Burns. Would the Senator yield on that point? 

The Chairman. I’d be happy to yield. 

Senator Burns. Explosives being carried on the airplane is not 
the danger. They’re not blowing up the airplanes; they’re running 
them into things. I think, basically, that’s not the priority. And 
then, how do you — if we don’t, under a suspect, have the right to 
surveil, I don’t see how we find these people. Some way or other, 
it seems to me that we have forfeited a little bit of our right to pri- 
vacy whenever terrorists decided to operate like they’re operating 
now. And to seek those people out who are the high-risk people, 
that’s really the travelers program. Yes, that deals with the major- 
ity of us; we’re the known. But whenever we get over to standing — 
oh, about the clandestine and the unknown. I’m going to leave that 
to the clandestine and covert people to collect that information. 

But to take a rigid line saying the President is — I’m not going 
to argue the legal end of it, but I will tell you, if I was sitting in 
that school room, and my aide comes in there and tells me I’ve got 
two buildings down, the Pentagon’s been hit, and there’s a plane 
down in Pennsylvania, and I’ve got to make a decision, there’s not 
very many of us that have occupied that seat, and I want all the 
information I can get before I jump, but I don’t have a lot of time 
to jump. And we’re all sworn to protect this country against all en- 
emies, foreign and domestic. And I think we’re venturing into an 
area here where we all sacrificed a little bit when what happened 
on — at 9/11. We all sacrificed. 

Thank you very much, Mr. Chairman. 
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The Chairman. Mr. Sparapani, has your organization taken a po- 
sition on the increase in fees for airline passengers that was dis- 
cussed here? 

Mr. Sparapani. Not directly, Senator. I wouldn’t want to speak 
whether it’s good from a free-enterprise perspective or not for these 
fees. But we all want the flying public to be safer. We’re trying to 
help. We want to work with you and this Committee, and the TSA, 
to make the flying public safer. And that’s the goal that we have 
and we cherish, as well. 

The Chairman. Thank you. 

Mr. Connors, do you depend on a poll of your members to present 
the statement you’ve presented here today? 

Mr. Connors. Presented — I’m sorry? 

The Chairman. Did you rely on a poll of your members, or some 
way to contact your members, for the statement that you are rep- 
resenting the whole National Business Travel Association. I take it 
these are operators of travel bureaus and things like that, right? 

Mr. Connors. No, actually our members are people within big 
corporations across the country who direct, manage, purchase, trav- 
el on behalf of all 

The Chairman. I see. 

Mr. Connors. — of those corporate travelers. 

The Chairman. Well, thank you 

Mr. Connors. So, they’re not agencies; they’re within cor- 
porate — 

The Chairman. How did you 

Mr. Connors. But, to answer your question, we did make a ref- 
erence to a survey that we did with our friends at TIA, where we 
surveyed frequent business travelers. And 92 percent of those 
wanted in on a concept, whatever that concept may look like in the 
end, called Registered Traveler. 

And I’d go a step further and — whether we have research or not, 
you’ve got an experiment down in Orlando that shows that there’s 
a tremendous demand for this. You’ve got only one airport, no 
interoperability, yet you’ve got 15,000 people down there who are 
willing to pay 80 bucks, give up all sorts of background informa- 
tion, and go through background checks. This obviously is going to 
have tremendous demand once you get more than one airport into 
the system. 

The Chairman. Did you discuss a limit on the cost of that card? 

Mr. Connors. We haven’t discussed that, and I think the mar- 
ketplace would bear that out. 

The Chairman. Do you have a list of what registered travelers 
would be willing to disclose to get a card? 

Mr. Connors. Well, that’s an interesting question. And we’re 
looking to TSA, to explain what they are going to ask for and what 
they will get in return. There are two models that are being dis- 
cussed, as far as Registered Traveler goes. There is the trust 
model, which is the one that you’re talking about, where we ask 
for more and more background information, and, based on that, 
we’ll give you the OK to be in the program. And there is the tech- 
nology model that says if we invest in certain technologies, we 
won’t need as much information, whether it’s foot-screening equip- 
ment, things like that to get people through without taking their 
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shoes off and all that kind of thing. We’re interested in pursuing 
both models hut, again, we’re just waiting for the details about 
what you need to provide for what you get. 

But you know, and I know, that there’s a spectrum of people out 
there that won’t be interested in this program at all. They don’t 
want to give up background information. That’s fine. It’s a vol- 
untary program. Then there are people on this end of the spec- 
trum — and I throw myself in this — who would probably give you 
blood, hair samples, DNA, whatever it is, to get through that air- 
port faster. 

And I think the experiment in Orlando shows that there’s a tre- 
mendous demand for this, even though the benefits are pretty 
minimal at this point. It’s one airport. And you can talk to the folks 
who are running that program. There are people buying cards for 
the Orlando Airport experiment who don’t live in Orlando. They’re 
just buying it on the back-end trip, because they do business there. 

So, we think there’s tremendous demand. And you made the 
point that we make all the time about this particular program, and 
that is, time is money. I represent America’s corporate travelers, 
and time is, indeed, money. I was a Registered Traveler here at 
Reagan Airport, and that program is no longer in use. When I go 
to the airport now I have a whole different time that I leave for 
the airport now. When I used to be in that program, I used to leave 
an hour before, and now I have to leave two 2 hours before. That’s 
an hour, times every single trip that I take. Time is money. 

The Chairman. Have you participated with TSA in the discus- 
sions of the details of the Registered Traveler program? 

Mr. Connors. We have, and we have been pleased that at least 
they’ve said, “Yes, we’re going to the next step.” Again, we would 
like to see more details about what they’re going to ask for, in 
terms of data on folks, and what they’re going to offer, in terms of 
benefits. 

The Chairman. I failed to discuss this with the prior panel, but 
I found out, in recent travel, that if you buy a one-way ticket to 
a certain destination — let’s take California — I was going there, and 
then I drove from that destination to another place, and then I had 
a ticket, going on. I was treated differently than if I had had a tick- 
et going from the first location. These segments are separated, and 
it brings about an additional delay. Do you think the Registered 
Traveler program can be managed to take out that delay so that 
a person having a series of tickets that are sort of looked at like 
they’re one-way tickets would be treated the same way as someone 
who had a roundtrip ticket? 

Mr. Connors. Right. Ideally, that’s where we’d like to see the 
program go, that there is interoperability between airports. So, all 
I need is my biometric card, and I won’t have that issue, whether 
it’s at that airport or the one that I’m transferring to. So, that’s 
why we’re hoping for interoperability. Additionally we know that 
the companies that are running this have airports signed up al- 
ready. They’re just waiting for that green light from TSA. 

The Chairman. Mr. May, I think as everyone realizes, this Com- 
mittee has jurisdiction over the airline system, as well as the TSA 
system. But we are very worried about the cost of these layered 
systems to the commercial aviation system, passenger system, be- 
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cause they’re already in trouble, with increased fuel costs and in- 
creased costs all over the system. Have you got any estimate of 
how much the industry itself has spent on security since 9/11? I 
mean, talk about what the companies have paid for CAPPS I, 
CAPPS II, Secure Flight, and now planning the registered system. 

Mr. May. Senator, I don’t have any hard-and-fast estimates in 
the aggregate since 9/11, but I think it’s fair to say that we’ve gone 
from spending somewhere in the range of $2.5 to $3 billion a year 
in imputed costs as a result of those security measures that we are 
required to perform because TSA won’t; i.e., that ticket-checker 
that you see when you stand in line is paid for by the airlines, not 
by TSA. When there is catering security, cargo security, it is paid 
for by the airlines, not by TSA. So, we’ve gone from roughly $3 bil- 
lion a year at the outset, of what we were paying in a total of 
taxes, fees, and imputed costs, to now something well over $4 bil- 
lion, and if the Administration’s proposals were to be adopted on 
the ASIF fee and the segment tax, you’d add another billion-four 
or -five to that. So, if you multiply out — that out times the number 
of years, it’s double-digit billions of dollars that this industry has 
paid for what we fundamentally believe is a function of national se- 
curity. 

The Chairman. Do you have any more questions. Senator? 

Senator Inouye. No, thank you. 

The Chairman. Well, we thank you all for coming. We thank the 
first panel, too. I do believe Mr. Connors has a point and that is 
that we have an ongoing review of the system. So, I would like to 
assure you that sometime by the end of May, we will be asking for 
additional information to see what, if anything, we might have to 
do to suggest a change in law or to find a way to deal with the 
complications of this security system. The airline passengers are 
the only ones that are paying for their security today, and the air- 
line companies are the only ones that are really paying totally for 
the security. And I think that the security system across all modes 
of transportation needs to have a review. We’ll talk about that 
later, too. 

But we do appreciate what you’re doing. I think, Mr. Hawley, 
we’re pleased with the way you’re moving forward and trying to get 
this program really to the point where it has greater support from 
the public. All of us in Congress, I think, get as much comment 
about this subject, of the delays in air transportation and the im- 
pacts of the security program, than any other subject we deal with. 

So, we hope to be back and have a — if not a formal hearing, at 
least a discussion with the participants sometime by late May to 
see what’s happened and what, if anything, we can do to assure 
that this program will mature and get to the point where it has, 
really, the support it needs from the traveling public. 

Well, we thank you very much. 

Senator do you have anything further? 

Thank you all very much. 

[Whereupon, at 11:55 a.m., the hearing was adjourned.] 
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APPENDIX 


Prepared Statement of Hon. Gordon H. Smith, U.S. Senator from Oregon 

Thank you Mr. Chairman for holding this important hearing to review the Trans- 
portation Security Administration’s Aviation Passenger Pre-Screening programs. 

The TSA faces a challenge ensuring the safety of those who travel on our airlines 
while preventing the screening process from becoming overly burdensome. While I 
understand the dilemma of balancing security and civil rights, I support the TSA’s 
attempts at determining potential risks prior to their boarding. 

I am concerned about potential cuts to Transportation Security Officers at Port- 
land International Airport (PDX) from 509 full-time equivalents to approximately 
356 full-time equivalents. This reduction is one of the largest decreases among U.S. 
airports both in percentage and in absolute terms. 

PDX is a critical transportation facility for both Oregon and Washington and 
plays a vital role in the Pacific Northwest’s economy. Serving 13 million passengers 
annually, Portland International Airport handles more than a quarter million tons 
of air cargo and provides 31 carriers with more than 500 passenger flights daily. 
It impacts over 75,000 jobs in the Portland metropolitan area and generates $3.5 
billion dollars annually for the region. 

Passenger traffic at PDX is growing dramatically, not shrinking as the cuts in the 
screening force would suggest. The current screening force at PDX is already strug- 
gling to handle existing passenger loads. A cut of this magnitude would increase 
passenger wait time and lead to a reduction in security for planes leaving Portland. 
Additionally, these concerns are shared by the Port of Portland, which owns PDX. 

I am concerned about the impact these cuts will have on the Portland Inter- 
national Airport’s security screening process, the stress this will place on the screen- 
ers and the amount of time it will take for the airport’s passengers to proceed 
through the security line. 

Thank you for taking your time to come before this Committee. I look forward to 
your testimony. 


Prepared Statement of Kevin P. Mitchell, Chairman, Business Travel 

Coalition 

Mr. Chairman and Members of the Committee thank you for inviting the Business 
Travel Coalition (BTC) to submit testimony on this important subject, and for your 
interest in the views of the customer of the commercial air transportation system. 

I. Background 

In the weeks immediately following 9/11, BTC conducted meetings in every region 
of the country to identify barriers to the return of business travelers to the skies, 
rental cars, hotel rooms and restaurants. A major theme in those meetings was the 
need for some sort of pre-screening program for business travelers, referred to then 
as “trusted traveler.” BTC has been advocating such a program since. 

During the ensuing years, Congress, DOT, TSA, DHS and other industry partici- 
pants’ interest has weixed and waned. However, business travelers have never lost 
interest in the now-called Registered Traveler (RT) program. BTC surveys since 
2001 and right up to January 2006 show a huge airport security screening problem 
and great business traveler frustration. Thankfully, Congress and TSA are now fully 
committed to RT program implementation, though misperceptions about the pro- 
gram and some marketplace confusion remain. 

II. Problem Statement 

“It is faster to clear El Al security than to get to the gate at a U.S. airport. It has 
taken me over 2 hours to reach the gate at Honolulu, San Diego, Rochester, Albany 
and DC in the past two months. Security is critical — but there MUST be a better 
way.” 

'This is a representative quote from one of 644 business travelers who participated 
in a January 2006 BTC survey. During peak business travel times, security screen- 
ing wait times can vary widely. This is a huge problem for business travelers, 64 
percent of whom responded that without a RT program they believed that wait 
times at their home airports would likely get worse. With air passenger growth ex- 
pected to be 3 percent to 5 percent over the coming years, and TSA’s screening 
budget shrinking, these travelers’ concerns appear well-founded. 

In a June 2005 BTC survey of 651 business travelers, 37 percent indicated that 
long lines were their #1 concern. Some 38 percent indicated that inconsistency of 
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screening processes and the unpredictability of wait times among airports was #1. 
Some observers dismiss such concerns by referring to average wait times posted by 
TSA. As a success metric, average wait times obscure much higher peak travel wait 
times, which tend to disproportionately impact business travelers, for example, en 
route to early morning meetings. This metric becomes more meaningful when the 
extra time that business travelers must pad their schedules with, due to screening 
time unpredictability, is added in. 

Unpredictability of wait times steals the business traveler’s valuable time. Not 
knowing whether an airport security line will be 5 or 50 minutes long requires that 
business travelers arrive at an airport 90 minutes or more in advance, sometimes 
cutting short a productive meeting with a client or important work in the office. The 
enterprise-wide productivity of the corporations that fund business travel activities 
is negatively impacted, and by extension, so is the national economy. 

Handicapped business travelers are especially impacted by current screening proc- 
esses and have been given very little attention in this debate. Theirs is an airport 
security experience of extra time, inconvenience and stress. Consider these state- 
ments from business travelers writing to BTC: 

“Give me a photo ID or take a picture of the stump of my missing right foot so 
I don’t have to undress each time I travel using airports.” 

“I’m handicapped missing my right foot. I wear special shoes. When I remove 
my shoes I can’t walk, I can only hop. Why can’t TSA give me a photo ID stating 
I’m handicapped so I’m not held up for additional screening^” 

“I have metal knees and activate the walk-thru detector. If I do not set it off, 
it is not working properly but I keep my mouth shut to avoid an airport 
lockdown. Thus, I know I will be subject to secondary screening and will have 
to take off my shoes.” 

III. Market Demand 

In an April 2002 BTC survey of 181 corporate travel managers, 69 percent of re- 
spondents indicated that they thought their travelers would support a “Trusted 
Traveler” program. In a follow-up June 2002 survey of 408 very frequent business 
travelers, 72 percent indicated they would support a “Registered Traveler” program 
to speed and improve the quality of airport security processes. Fast forwarding to 
a 2005 BTC survey, 77 percent of business travelers indicated they would “strongly 
support” or “support” a Registered Traveler program. 

Of course, surveys do not always tell the whole story. It was not until July 2005 
that the industry had a chance to see if true marketplace demand would mate- 
rialize. The Orlando airport contracted with a RT service firm to provide services 
for $79.95 per member, per year. Over 14,000 travelers have enrolled to date. Feed- 
back from members has been overwhelmingly positive. (Listen to RT member inter- 
view on BTC Radio at http: 1 1 btcblog.typepad.com / btcradio / . ) 

Another important indicator of demand is that the majority of major North Amer- 
ican airports are actively investigating the RT program responding to business trav- 
eler demand in their markets. Several have already made decisions to implement. 
Likewise, many North American airlines are keenly interested in the program. 

IV. RT Program Benefits 

A. RT Members 

The major benefit of a RT program, from the perspective of the business traveler, 
is the high degree of certainty regarding an efficient processing through airport se- 
curity. There are other benefits under consideration by TSA such as not having to 
remove shoes, laptops, or outer clothing. Such benefits will come after RT service 
providers implement enabling service lane technologies. 

Notwithstanding the importance of the benefits above, RT members stand to ben- 
efit in other ways such as: 

1) Customer Service. A RT program member at Orlando called the customer 
service “beyond excellent” and spoke of being “pampered” by the RT service pro- 
vider’s staff. This is important and valued by business travelers. 

2) Interoperability. Today a business traveler flying out of a major hub likely 
has access to an airline’s Elite security line, if they qualify. However, at least 50 
percent of a business traveler’s experience is at his non-home airport where there 
may or may not be an Elite line hosted by his preferred airline. Moreover, many 
business travelers originate out of mid-size airports where such Elite lines may not 
exist. TSA has rightly set a standard that mandates that a RT member can use his 
card, without additional cost, at any airport serviced by any RT service provider. 
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Interoperability is not a big technological challenge. (See Addendum: BTC Interoper- 
ability Statement). 

3) Boarding Passes. The ability to go through security and secure a boarding 
pass on the air side would benefit business travelers and bring relief to kiosk sta- 
tions during peak times. 

4) Smaller Land Side Crowds. Avoiding large crowds on the relatively low-secu- 
rity land side of an airport is important as airport lobbies have been historically 
high profile, easy terrorist targets. Moving business travelers through security effi- 
ciently, and improving overall security system throughput, is prudent risk manage- 
ment. Corporate Risk Managers would value having traveling employees enter the 
more secure air side of an airport as quickly as possible. 

5) Safer Travel. Since 9/11, the so-called security hassle has caused many busi- 
ness travelers to drive their cars in short-haul markets (under 500 miles). The fall- 
off has only partially rebounded. Southwest Airlines, for example, still reports a 20 
percent decline in short haul for its Love Field operations. Driving a car is exceed- 
ingly more dangerous than traveling by airplane. More efficient security would help 
save lives on the highways, reduce congestion and help the environment. 

6) Handicapped Travel. Greater respect, customer service and convenience 
await the thousands of handicap travelers who navigate North American airports. 

B. Benefits: Traveling Public 

1) Faster Proeessing. A properly functioning RT program, in the mold of the 
interstate electronic fast pass tolling, will improve the overall throughput for non- 
RT program travelers saving them time. For example, a dedicated RT lane, that rep- 
resents 10 percent of the throughput capacity, could actually handle 15 percent or 
more of the passengers due to the prescreening and service configuration effi- 
ciencies. Public security lines will not become longer. Moreover, where physically fea- 
sible, RT vendors will likely pay for the construction and equipping of entirely new 
lanes. 

2) Smaller Crowds. With business travelers bypassing land side kiosks for board- 
ing passes and moving through security quickly, and overall faster security system 
throughput, the traveling public’s experience and safety will improve. 

C. Benefits: TSA 

1) Optimizing Limited Resources. Air traffic is expanding, TSA’s budget is 
shrinking. RT allows TSA to NOT focus on 100 percent of passengers as if they were 
all equal threats to the aviation system. RT will allow TSA to focus its limited re- 
sources of money, time, people and equipment on a smaller subset of the traveling 
public. 

2) Enhanced Security. In joining a RT program, a traveler receives better serv- 
ice in return for being subjected to a higher level of information-based security, and 
physical security screening. An example would be a shoe scanner that is paid for 
by the RT provider and deployed to identify explosives. Such a device would be used 
so that a RT member would not have to remove his shoes. This technology is supe- 
rior to X-ray machines currently used. As such, the 10 percent to 15 percent of trav- 
elers who generate 40 percent to 50 percent of airports’ traffic will actually receive 
greater security scrutiny making the overall system more secure. 

3) Crowd Control. As mentioned, TSA’s mission would be supported if the large 
crowds that often build up on the land side were significantly reduced. 

4) Customer Service. TSA will be implementing a randomizing of RT processes 
and benefits. This represents a best-in-class security approach in use throughout the 
world and is not mutually exclusive of the desire of business travelers wanting more 
certainty in the screening process. What business travelers want is the certainty of 
the amount of time they will need to budget for security, not the absolute predict- 
ability of process components. Add to this the enhanced customer service provided 
by the RT providers and TSA can be commended for improving the customer service 
result. 

D. Benefits: Airlines 

1) Cost. RT service providers and their customers will incur all the costs of estab- 
lishing, marketing and operating the program. Moreover, some RT providers will 
likely be willing to revenue share with airlines in turn for their help in marketing 
the program to their frequent flyer bases. 

2) Additional Passenger Revenues. The last 6 airline passengers who board 
typically make the difference between profit and loss on a given flight. A consistent, 
positive security experience will bring back many of those high-yield business trav- 
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elers who have abandoned airlines for automobiles, trains, limos, buses, fractional 
jets and other options, including not taking a trip. 

3) Customer Service. The RT program will provide the opportunity for excep- 
tional customer service for airlines’ best customers. 

E. Benefits: Airports 

1) Better Service. Business travelers can comprise 10 percent to 20 percent of 
an airport’s total customer base, but 40 percent to 50 percent of its traffic. Clearly 
it is every airport architect’s and operator’s mission to service these important cus- 
tomers well. RT is a strategic solution to this problem. 

2) Revenues. Winning back business travelers who have defected to other modes 
of transportation or communications technology, e.g., video conferencing, is a pri- 
ority for airports. It has a direct bearing on maintaining air services to many mar- 
kets. Likewise, airports benefit from greater parking and concession revenue with 
increased numbers of business travelers. 

3) Crowd Control. As previously mentioned, moving passengers from the less se- 
cure land side of an airport to the air side enhances the overall security environ- 
ment. Additionally, the more time passengers have on the air side, the more they 
will spend in stores generating revenue for the airport. 

V. Private Sector Rationale 

The private sector’s primary role will be to work with airport authorities to estab- 
lish and market a RT program. TSA will set and oversee security standards. RT pro- 
viders will be encouraged, through marketplace forces, to continually enhance the 
customer service experience in the RT lane. The competencies required for success 
include branding, consumer marketing, subscription-based services and strategic 
marketing alliances. These are not the usual competencies found in governments. 

VI. Privacy 

Business travelers have become sensitive to data privacy issues, particularly over 
the past few years. TSA and airlines have misused data, and commercial data 
aggregators have failed in their mission to protect consumers’ information. Identity 
theft is on the rise. For RT to work system-wide it needs a critical mass of members, 
supported by low member costs, met service expectations and strict privacy protec- 
tions. 

The Orlando RT model, having generated 14,000 members to date, appears to 
have hit the mark with the RT service provider’s data privacy commitments. TSA’s 
proposal to use commercial databases as an exclusive way to provide additional RT 
program benefits is overreach in BTC’s view, and could significantly dampen busi- 
ness traveler demand for the RT program. 

VII. Equity 

Some observers are of the view that the RT program asks a citizen to pay a fee 
to demonstrate that he or she is not a terrorist risk, and some find this offensive. 
However, no one is asking a citizen to do anything. The marketplace and capital 
providers are simply offering a service. Moreover, travelers are pa 3 dng today, 
through TSA security fees, to demonstrate that they are not terrorist threats before 
they are allowed to board a plane. Importantly, all costs associated with the RT pro- 
gram will be borne by RT service providers and their customers, not taxpayers. 

Mr. Chairman, BTC is very supportive of the RT prowam and appreciative of a 
renewed TSA commitment to reach out to the travel industry for input. We believe 
we are on the cusp of creating the best airport security protocol in the world. 

Thank you for the opportunity to contribute. 

Addendum: BTC Interoperability Statement 

Registered Traveler Interoperability 

Business Travel Coalition, January 2006 

The June 2005 launch of the Orlando Registered Traveler program marked the 
expansion of the Registered Traveler program to the private sector. The Transpor- 
tation Security Administration (TSA) had incubated the program by testing tech- 
nology and piloting the overall concept at five airports. With Orlando, it was turned 
over to the private sector for a rollout that would be self-supported. Orlando Reg- 
istered Travelers have begun to receive their Clear Cards, from Verified Identity 
Pass Inc., the program service provider, and are utilizing a designated “fast lane” 
and line at Orlando airport. 

As Registered Traveler (RT) programs expand, travelers will be able to use fast 
lanes at other airports across the country. Since TSA has mandated that private 
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sector RT programs be interoperable, Registered Travelers will benefit from the pro- 
gram network no matter what company provides their card. 

Standards To Be Set 

Since testing the technology in the pilots, TSA has aimed to make the programs 
interoperable so that members who enrolled at Los Angeles, for example, could use 
their cards at Dulles. Making the pilot programs interoperable has been more dif- 
ficult than it will be to make future RT programs interoperable. That’s because, in 
order to test different technologies, TSA purposely created five completely separate 
programs that used different hardware and software. That was the point: to test dif- 
ferent technologies. This complication makes linking the pilot pro-grams, so that 
they are interoperable with their present configurations, a hurdle. 

However, interoperability among future programs — and even between and among 
the pilot airports — is not actually a difficult issue if the pilots are viewed as testbeds 
for establishing the common, interoperable standard. Indeed, TSA, after testing the 
technology in the pilot programs, seems to have set a standard in Orlando that serv- 
ice providers will use for future RT programs. 

TSA combined the use of iris images and fingerprint images, and in detail pro- 
vided a technical spec for the operation of the program. Thus, to make the existing 
pilot programs interoperable with Orlando and future RT programs, the simplest 
way would be for pilot airports to require any RT service provider bidding to set 
up shop for a rolled-out private sector program to agree to reissue the existing mem- 
bers’ cards for free in return for their having participated in the pilot. It is cheaper 
and easier than trying to create a software fix that will not be necessary in the fu- 
ture. 

Put simply, interoperability is an obstacle easily overcome by taking the stand- 
ards set by TSA in Orlando (or for that matter any modified standard that TSA sets 
once it sees how operations work in Orlando) and applying them to future RT pro- 
grams. 

Clearinghouse Structure 

The second interoperability issue has to do with a clearinghouse that would com- 
bine the names of those enrolled in RT programs at various airports and by service 
providers. Someone enrolled in a program at O’Hare run by service provider A must 
be able to have his card recognized hy a program at Tampa run by service provider 
B. Thus, a clearinghouse would be needed to collect the names of currently valid 
members and send them along with daily updates to all the kiosks run by all of 
the providers at all of the airports. 

This represents a simple technology challenge, given that TSA has already set 
common membership criteria (it approves all members based on one standard), and 
apparently set the common technology standards for biometric capture and the 
smart card. The primary requirements of the clearinghouse would be meeting the 
strictest privacy and security requirements set by the service providers, having the 
trust and confidence of TSA, and the ability to do this without adding more than 
a few pennies of cost to the customer for this relatively simple task. 

In short, with TSA having heen active in the hard work of setting the technology 
and security standards, the path to interoperability is not nearly as difficult as it 
has been depicted. 


American Society of Travel Agents 
Alexandria, Virginia, February 21, 2006 

Hon. Ted Stevens, 

Chairman, 

Senate Committee on Commerce, Science, and Transportation, 

Washington, DC. 

Dear Senator Stevens: 

The American Society of Travel Agents (ASTA) applauds your efforts in holding 
the February 9, 2006 oversight hearing on commercial aviation security. ASTA 
wishes to go on record with respect to the Department of Homeland Security (DHS) 
Transportation Security Administration’s (TSA) passenger screening programs Reg- 
istered Traveler and Secure Flight. We ask that this letter become part of the offi- 
cial hearing record. 

ASTA was established in 1931 and is today the leading professional travel trade 
organization in the world. Its current membership consists of approximately 5,800 
travel agents across the Nation, with a total membership of 13,700 members in 
some 138 countries. ASTA’s corporate purposes specifically include promoting and 
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representing the views and interests of travel agents to all levels of government and 
industry, promoting professional and ethical conduct in the travel agency industry 
worldwide, and promoting consumer protection for the traveling public. 

Public confidence in our Nation’s security is essential to the maintenance and 
growth of travel demand. Federal policies and practices can and do influence the 
demand for and the cost of delivering travel services. A careful balance between se- 
curity and the flow of travelers requires passenger screening procedures to be free 
of unreasonable restrictions and obstacles that deter people from traveling. ASTA 
supports the permanent implementation of TSA’s Registered Traveler program 
which will efficiently enhance the facilitation of the screening process for those fre- 
quent travelers who have voluntarily opted to qualify in advance. 

In a related vein, the proposed regulations for Federal programs such as Secure 
Flight and the Centers for Disease Control and Prevention’s Control of Commu- 
nicable Diseases are major concerns for the travel agency industry. These programs 
are proposing the additional collection of passenger information and data by the pri- 
vate sector. The time has come for the U.S. Government to streamline and stand- 
ardize passenger data collection across Federal agencies before any new regulations 
are adopted. 

On behalf of the thousands of travelers that travel agents service throughout the 
year, we thank you again for your leadership role in reviewing the issues pertaining 
to passenger pre-screening in the post-September 11 world. 

Sincerely, 


Kathryn W. Sudeikis, CTC, 

President. 


Response to Written Questions Submitted by Hon. Ted Stevens to 
Hon. Edmund “Kip” Hawley 

Question. Mr. Hawley, how much time and how much money have you spent on 
Secure Flight? 

Answer. Exclusive of any spending for CAPPS H, some of which has also benefited 
Secure Flight, during the 18-months Secure Flight has been active, August 2004 
through February 2006, the program has obligated $52.8 million in support of this 
effort. When spending on CAPPS II and projected obligations for Fiscal Year 2006, 
expected to total $42.2 million, are included, approximately $144 million has been 
obligated since November 2002. 


Response to Written Questions Submitted by Hon. Ted Stevens to 
Cathleen a. Berrick 

Question. Do you know the approximate number of man-hours and amount of 
funding that GAO has devoted to assessing the Secure Flight program? 

Answer. Our review of the Secure Flight program, and of the Computer-Assisted 
Passenger Prescreening System II (CAPPS-II) — the predecessor to Secure Flight — 
have provided a detailed status of the programs’ development and implementation 
to the Congress and have resulted in thirteen recommendations to the Department 
of Homeland Security (DHS) and the Transportation Security Administration (TSA) 
designed to help ensure the programs’ successful implementation. In response to 
mandates contained in Fiscal Years 2004, 2005, and 2006 appropriations legisla- 
tion, 1 and bi-partisan requests from eight Congressional committees, GAO has dedi- 
cated approximately 4.5 full time equivalent staff per year to review these programs 
since June 2003. During this time, we issued five reports, testified three times be- 
fore several Congressional Committees, and provided numerous briefings to Con- 
gressional staff. Our work also contributed to several additional testimonies before 
Congressional Committees on TSA’s overall efforts to strengthen the security of 
commercial aviation. TSA reported spending approximately $144 million on the de- 
velopment of Secure Flight. 

As TSA proceeds towards implementation of Secure Flight, the FY 2006 appro- 
priations legislation requires (1) DHS to certify that the program has addressed 10 
areas related to the systems development and implementation and, (2) GAO to re- 
port to the Congress on DHS’s certification of these issues no later than 90 days 


^The Department of Homeland Security Appropriations Act, 2004, Pub. L. 108-90, §519, 117 
Stat. 1137, 1155-56 (2003); Department of Homeland Security Appropriations Act, 2005, Pub. 
L. No. 108-334, §522, 118 Stat. 1298, 1319—20 (2004); and Department of Homeland Security 
Appropriations Act, 2006, Pub. L. 109-90, §518, 119 Stat. 2064, 2085 (2005). 
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after DHS certification. ^ In accordance with this legislation, DHS can certify that 
Secure Flight has satisfied these 10 areas at any time either incrementally or in 
total, and does not have to wait for a GAO review to do so. Further, in an effort 
to be as constructive as possible, we have offered to provide to TSA the specific cri- 
teria we plan to use to review their certification of the 10 areas, and are exploring 
additional ways in which we can provide assistance to TSA as development pro- 
gresses while maintaining our independence. We also appreciate the challenges TSA 
faces that are inherent in the development of a program such as Secure Flight, and 
will continue to work to minimize any impact our work may have on TSA as we 
conduct the remainder of our review. 


o 


2 Section 518 of the FY 2006 Appropriations Act references the ten areas related to systems 
development and implementation listed in section 522 of the FY 2005 Appropriations Act. 



